SC-010: Nation-State APT — Long-Term Espionage Campaign¶

Threat Actor Profile¶

APT-X (internal tracking designation; MISP cluster: intrusion-set--apx-2024) is a Chinese state-sponsored threat group attributed with high confidence to PLA Unit 61486. The group has operated since at least 2017, targeting defense prime contractors, aerospace manufacturers, and research institutions in the United States, United Kingdom, Australia, and Japan.

APT-X is distinguished by extreme operational patience. Average dwell times exceed 180 days before exfiltration begins. The group avoids commercial malware families (no Cobalt Strike, no Metasploit), instead deploying custom implants with modular architecture. Their GHOSTDUST implant family uses legitimate cloud services (OneDrive, Dropbox, GitHub Gist) as dead-drop command-and-control channels — making C2 traffic indistinguishable from normal business use.

The group extensively uses Living-off-the-Land (LOTL) techniques post-exploitation: certutil.exe, wmic.exe, ntdsutil.exe, scheduled tasks for persistence, and native Active Directory tooling for reconnaissance. No offensive security tools are staged on victim systems.

Motivation: Strategic intelligence — ITAR-controlled engineering drawings, program schedules, personnel lists for targeting, technology transfer for domestic production.

Scenario Narrative¶

Phase 1 — Initial Access (Month 0, ~45 min)¶

APT-X spends 3 weeks in reconnaissance before attack. They register partnerlink-contoso[.]com (typosquatting Contoso's legitimate partner portal) and build a profile of Marcus Webb, Senior Program Manager for the classified FALCON project, from LinkedIn, conference presentations, and DOD contractor databases. They craft a spearphishing email appearing to come from a legitimate business partner with a PDF: FALCON_Program_Review_Draft_Q1.pdf.

The PDF exploits CVE-2024-21338 (a zero-day in Adobe Reader's JavaScript engine at the time of the campaign). The exploit executes shellcode that reflectively loads the GHOSTDUST implant directly into memory via process injection into svchost.exe -k netsvcs. No file touches disk. The implant beacons to onedrive.com/personal/ghostd_sync_c2/... — a legitimate OneDrive account controlled by APT-X.

Evidence Artifacts:

Phase 2 — Persistence & Stealthy Reconnaissance (Month 0–1, ~45 min)¶

GHOSTDUST establishes persistence via COM object hijacking (HKCU\Software\Classes\CLSID\{89565275-...}) — a technique that survives reboots without touching common persistence locations (HKLM\...\Run, scheduled tasks, services). The implant beacons every 4 hours with ±20-minute jitter. C2 check-ins are disguised as OneDrive sync traffic: HTTP PUT requests to a 1KB "document" on the attacker's OneDrive.

Over 30 days, APT-X conducts AD reconnaissance entirely with native tools: net group "Domain Admins" /domain, LDAP queries for AdminCount=1 accounts, nltest /dclist, and dsquery * -filter "(userAccountControl:1.2.840.113556.1.4.803:=8192)" to identify service accounts. They map the network topology, identify the FALCON project share server (PROJ-SRV-04), and note that it is accessible via WinRM from Marcus's workstation.

Evidence Artifacts:

Phase 3 — Lateral Movement & Data Staging (Month 1–4, ~60 min)¶

APT-X uses WinRM (winrm.cmd) from Marcus's workstation to connect to PROJ-SRV-04 — the FALCON project file server. WinRM is enabled by Group Policy for IT management; the connection uses Marcus's legitimate credentials (obtained via keystroke logging built into GHOSTDUST). No pass-the-hash, no Kerberoasting — purely credential-based lateral movement that appears identical to legitimate remote administration.

On PROJ-SRV-04, APT-X locates and accesses 14 ITAR-controlled engineering drawings and 3 classified program schedules (marked FOUO). Files are staged in C:\Windows\Temp\~dfca4c.tmp (timestomped to match Windows Update cache files). The attacker compresses the collection with a custom tool named tmdump.exe (masquerading as a Windows Memory Diagnostic utility). Exfiltration occurs via DNS-over-HTTPS to cloudflare-dns.com — each DNS query encodes 32 bytes of exfiltrated data. 100MB/week exfiltration rate — total: 400MB over 4 months.

Evidence Artifacts:

Phase 4 — Detection & Supply Chain Pivot Attempt (Month 6, ~45 min)¶

IT's routine 90-day password rotation cycle resets Marcus Webb's credentials. GHOSTDUST loses access — the C2 channel goes silent. APT-X attempts re-infection via supply chain: they compromise a tier-2 software vendor DevSuite Inc. that supplies Contoso's build environment. They inject a backdoored update into DevSuite Compiler v4.2.1 — the update binary is signed with DevSuite's legitimate code signing certificate (which APT-X stole in a prior operation).

The update is blocked at Contoso by Windows Defender Application Control (WDAC), which enforces an allow-list of signed publishers. A WDAC block event fires in the Security Event Log. An alert-hungry junior analyst notices the block, escalates, and the SOC initiates a retrospective investigation — pulling 6 months of EDR telemetry from Marcus's workstation and discovering the full GHOSTDUST campaign.

Evidence Artifacts:

Detection Opportunities¶

Key Discussion Questions¶

1. The total dwell time was 6 months. Your EDR had telemetry covering the entire period. What organizational process would have detected this within 30 days via proactive threat hunting?
2. APT-X used OneDrive for C2 — a service your organization cannot block. What detective controls are available when you cannot block the C2 channel?
3. 400MB of ITAR-controlled data was exfiltrated. What technical control (not policy) would have prevented or detected this data leaving the PROJ-SRV-04 file server?
4. The supply chain pivot used a legitimately-signed binary. How would you design a WDAC policy that mitigates this threat while remaining operationally viable for a 3,000-user enterprise?
5. The initial MDE alert (Medium severity) was triaged as a false positive. What criteria should your SOC use to escalate process injection alerts involving Adobe Reader, given the high false-positive rate?

Debrief Guide¶

What Went Well¶

• WDAC blocked the supply chain pivot — compensating control worked as designed
• EDR telemetry was preserved and enabled 6-month retrospective reconstruction
• Alert fatigue was the root cause of missed detection — not a telemetry gap

Key Learning Points¶

• Nation-state APT operates on patience timescales — weeks of reconnaissance, months of dwell — traditional alert-based detection optimized for fast-moving ransomware will miss these actors
• Living-off-the-Land makes behavioral detection essential — no malware signature will fire; only behavioral baselines and anomaly hunting can surface LOTL activity
• DoH is a detection gap — many organizations have no visibility into DNS-over-HTTPS and no policy blocking it to non-approved resolvers
• WDAC is highly effective — publisher-based rules + allow-list blocked a signed supply chain binary; hash-based rules would have been even more resilient

Recommended Follow-Up¶

• [ ] Implement proactive threat hunting cadence: minimum monthly hunt using behavioral hypotheses
• [ ] Deploy beacon detection analytics in SIEM (periodic connection analysis with jitter modeling)
• [ ] Enforce WDAC in audit mode → block mode over 90 days; prioritize privileged systems first
• [ ] Block outbound DoH to all resolvers except approved corporate resolver; inspect DNS
• [ ] Enroll in DIB CS (Defense Industrial Base Cybersecurity) program for threat intel sharing
• [ ] Apply ITAR data classification labels and DLP policies to all controlled files
• [ ] Run red team exercise simulating GHOSTDUST beacon pattern — measure detection time

References¶

• Chapter 22: Threat Actor Encyclopedia
• Chapter 7: Threat Intelligence & Context
• Chapter 27: Digital Forensics
• Chapter 28: Advanced Incident Response
• Chapter 38: Advanced Threat Hunting