{"id":11167,"date":"2025-03-21T11:23:08","date_gmt":"2025-03-21T11:23:08","guid":{"rendered":"https:\/\/fusionmindlabs.com\/blogs\/10-month-campaign-hits-7-targets\/"},"modified":"2025-03-21T11:23:09","modified_gmt":"2025-03-21T11:23:09","slug":"10-month-campaign-hits-7-targets","status":"publish","type":"post","link":"https:\/\/fusionmindlabs.com\/blogs\/10-month-campaign-hits-7-targets\/","title":{"rendered":"10-Month Campaign Hits 7 Targets"},"content":{"rendered":"\n<\/p>\n
\n

\ue802<\/i>Mar 21, 2025<\/span>\ue804<\/i>Ravie Lakshmanan<\/span><\/span>Cybercrime \/ Cyber Espionage<\/span><\/p>\n<\/div>\n

\n
\n<\/p>\n

<\/a>\n<\/div>\n

A China-linked advanced persistent threat (APT) group, known as Aquatic Panda<\/strong>, has been linked to a global espionage campaign that occurred in 2022, targeting seven organizations across various countries.<\/p>\n

These targeted entities include governments, Catholic charities, non-governmental organizations (NGOs), and think tanks in Taiwan, Hungary, Turkey, Thailand, France, and the United States. The campaign, which took place over a period of ten months between January and October 2022, has been codenamed Operation FishMedley by ESET, a Slovakian cybersecurity company.<\/p>\n

According to security researcher Matthieu Faou, “Operators used implants, such as ShadowPad, SodaMaster, and Spyder, which are common or exclusive to China-aligned threat actors.” More information on this can be found in his analysis<\/a>.<\/p>\n

\n

\n
\n\"Cybersecurity\"
\n<\/a>
\n<\/center>\n<\/div>\n

Aquatic Panda<\/a>, also known as Bronze University, Charcoal Typhoon, Earth Lusca, and RedHotel, is a Chinese cyber espionage group known to be active since at least 2019. The group is tracked by ESET under the name FishMonger.<\/p>\n

Aquatic Panda is said to operate under the umbrella of the Winnti Group (also known as APT41, Barium, or Bronze Atlas) and is overseen by the Chinese contractor i-Soon. Some employees of i-Soon were charged<\/a> by the U.S. Department of Justice (DoJ) for their involvement in multiple espionage campaigns between 2016 and 2023.<\/p>\n

\n
\n\"\"
\n<\/a>\n<\/div>\n

The group has been linked<\/a> to a late 2019 campaign targeting universities in Hong Kong, utilizing ShadowPad and Winnti malware, an intrusion set tied to the Winnti Group.<\/p>\n

The 2022 attacks involved the use of five different malware families, including a loader named ScatterBee<\/a>, which drops ShadowPad<\/a>, Spyder<\/a>, SodaMaster<\/a>, and RPipeCommander. The initial access vector used in the campaign is currently unknown.<\/p>\n

\n

\n
\n\"Cybersecurity\"
\n<\/a>
\n<\/center>\n<\/div>\n

According to ESET, “APT10 was the first group known to have access to [SodaMaster], but Operation FishMedley indicates that it may now be shared among multiple China-aligned APT groups.”<\/p>\n

RPipeCommander is a previously undocumented C++ implant used against a governmental organization in Thailand, functioning as a reverse shell capable of running commands using cmd.exe and gathering outputs.<\/p>\n

As noted by Faou, “The group is not shy about reusing well-known implants, such as ShadowPad or SodaMaster, even long after they have been publicly described.”<\/p>\n

<\/p>\n

Found this article interesting? Follow us on Twitter \uf099<\/i><\/a> and LinkedIn<\/a> to read more exclusive content.<\/div>\n<\/div>\n