APT30

APT30, a threat actor suspected to be attributed to China, has been active since at least 2005. This group primarily targets members of the Association of Southeast Asian Nations (ASEAN). APT30 is notable for its sustained activity over an extended period and its ability to adapt and modify source code to maintain consistent tools, tactics, and infrastructure. They frequently register their own DNS domains for malware Command and Control (CnC) activities. The associated malware includes SHIPSHAPE, SPACESHIP, and FLASHFLOOD, with attack vectors including downloaders, backdoors, a central controller, and components designed to infect removable drives and cross air-gapped networks to steal data. The Naikon APT group, which aligns with APT30 as per FireEye's revelations, was spear-phished by another actor known as "Hellsing." However, no exact matches have been discovered between these two groups yet. The EU Cybersecurity Agency (ENISA) and the Computer Emergency Response Team for the EU institutions, bodies, and agencies (CERT-EU) have issued advisories on Advanced Persistent Threats (APTs), including APT30, highlighting the ongoing threat posed by such actors. Several Chinese hacking groups, including APT27, APT30, APT31, Ke3chang, GALLIUM, and Mustang Panda, have been identified in joint reports focusing on cyber activities. These groups are known for their malicious activities, further emphasizing the persistent cybersecurity threats originating from China. Despite the varying tactics and targets, these groups collectively underscore the need for robust cybersecurity defenses and constant vigilance against potential threats.