SloppyLemming Espionage Campaign Targets South and East Asia

Introduction

On September 24, 2024, Cloudforce One published an extensive investigation into a sophisticated espionage campaign orchestrated by the advanced threat actor known as SloppyLemming. This actor has been active since late 2022, predominantly targeting organizations in Pakistan, Bangladesh, Sri Lanka, and China. Through the use of various cloud service providers, SloppyLemming has leveraged phishing campaigns, credential harvesting, and malware distribution to compromise critical sectors, including government, law enforcement, telecommunications, and energy.

Report Overview

SloppyLemming, which Cloudforce One aligns with CrowdStrike's OUTRIDER TIGER, conducts widespread cyber operations across South and East Asia, with a specific focus on Pakistan. Cloudforce One's visibility into the actor's operations revealed the use of Cloudflare Workers to facilitate credential harvesting, malware delivery, and command and control (C2) communications. The campaign primarily involves phishing attacks that impersonate legitimate organizations to steal credentials and compromise email accounts.

The threat actor shows a noticeable lack of operational security (OPSEC), allowing Cloudforce One to gain insight into their tooling and methods. Investigators identified custom-built tools like CloudPhish, which automates the creation of malicious cloud infrastructure, enabling the actor to exfiltrate credentials and emails from targeted organizations.

SloppyLemming’s credential harvesting operations begin with spear-phishing emails designed to mimic legitimate correspondence from trusted sources. These emails include links to fake login portals created using Cloudflare Workers. Once a target enters their credentials, the information is sent to the threat actor via a Discord webhook.

Cloudforce One obtained a script used by the actor, which automates the process of harvesting emails from compromised accounts. The script, written in Python, logs into the victim's email inbox, navigates through emails, and downloads any attachments. The script further demonstrates how the actor gains persistent access to sensitive information, exploiting vulnerabilities in platforms like Google OAuth to steal tokens and exfiltrate data.

Moreover, SloppyLemming has been observed leveraging CVE-2023-38831, a vulnerability in older versions of WinRAR. The actor uses this exploit to deploy malware from cloud services like Dropbox, with the final payload being a remote access tool (RAT) designed to establish long-term access to victim systems.

SloppyLemming’s operations have been far-reaching, with a clear focus on Pakistani government and defense entities. Other high-profile targets include law enforcement agencies, energy sector organizations, and technology firms. Beyond Pakistan, Cloudforce One identified additional victims in Bangladesh, Sri Lanka, Nepal, and China.

Interestingly, the campaign has expanded to include a small but significant amount of C2 traffic from Australia, hinting at potential government-related targeting. SloppyLemming’s focus on credential harvesting, token collection, and malware deployment poses a severe risk to national security, critical infrastructure, and private sector organizations in the region.

Insights and Analysis

Cloudforce One, in collaboration with other industry partners such as Dropbox, Github, and Discord, has taken proactive measures to disrupt SloppyLemming’s operations. In total, Cloudforce One successfully mitigated 13 Cloudflare Workers involved in the campaign and deployed advanced detection capabilities to thwart future attacks.

To defend against SloppyLemming, Cloudforce One recommends the following steps:

1. Implement Zero Trust architecture: Ensure all access points within the network are continuously verified.
2. Deploy Endpoint Detection and Response (EDR): Tools like CrowdStrike or Microsoft Defender should be used to monitor and prevent malicious activities on endpoints.
3. Monitor for Indicators of Compromise (IOCs): Regularly scan your environment for IOCs, including domain names and malware samples associated with SloppyLemming.
4. Update Systems: Ensure all systems, especially those using WinRAR and Microsoft products, are up-to-date to mitigate vulnerabilities like CVE-2023-38831.

SloppyLemming’s activities highlight the growing threat of state-sponsored cyber espionage campaigns targeting critical industries in South and East Asia. Organizations operating in these regions should remain vigilant, adopt comprehensive security measures, and regularly monitor for potential signs of compromise.

Indicators of Compromise (IOCs)

MITRE ATT&CK Mapping

References

Unraveling SloppyLemming’s Operations Across South Asia

Cloudforce One has tracked a persistent, state-aligned actor targeting regional governments, militaries, energy and technology organizations across South and East Asia.

Cloudflare