Camaro Dragon

Camaro Dragon, a Chinese state-sponsored threat actor also known as Stately Taurus, Mustang Panda, Bronze President, Red Delta, Luminous Moth, and Earth Preta, has been active since at least 2012. In 2023, Checkpoint Research discovered a custom firmware image linked to Camaro Dragon that contained several malicious components, including an implant dubbed "Horse Shell". This group was found exploiting TP-Link routers via a malicious firmware implant in attacks on European foreign affairs entities. Notably, the IP address to which Horse Shell's C&C resolves is listed in Avast's report on Mustang Panda's activities. Significant overlaps between Mustang Panda and Camaro Dragon suggest that this router implant has likely been deployed in other campaigns by the group. The analysis of these implants provides insight into the techniques and tactics utilized by the Camaro Dragon APT group, demonstrating how threat actors use malicious firmware implants in network devices for their attacks. For instance, USB drives were identified as a primary infection vector for three major threat groups in 2023, including Camaro Dragon, as noted by Maya Horowitz, vice president of research at Check Point, in her keynote presentation at CPX 2024 in Las Vegas. The reach of Camaro Dragon's activities extends beyond institutional targets, with one incident involving a UK hospital employee unknowingly infecting the hospital's entire corporate network after catching the Camaro Dragon malware from an infected colleague. Given the capabilities exhibited by China-aligned threat actors such as Evasive Panda and TheWizards, as well as recent research on router implants attributed to BlackTech and Camaro Dragon, it is speculated that the attackers are deploying a network implant in the networks of the victims, potentially targeting vulnerable network appliances like routers or gateways.