Crimson

Crimson is a type of malware that has been used in various cyber-espionage campaigns, notably by ProjectM. The malware was first observed in 2013 and has been continuously employed in attacks alongside other payloads like Capra RAT and Oblique RAT. ProjectM used multiple domains to control the Crimson, Andromeda, and Peppy Trojans, one of which was "sahirlodhi[.]com". This domain was also used as the download location for a sample of the Crimson tool. Additionally, ProjectM leveraged blogs with Indian themes, such as the India News Tribe (intribune[.]blogspot[.]com), to deliver Crimson payloads. The most recent and significant use of Crimson malware is in a long-term, Chinese state-sponsored cyber-espionage operation dubbed “Crimson Palace”. Unearthed by Sophos Managed Detection and Response, this complex operation involved three different threat teams conducting coordinated attacks against a Southeast Asian government agency. The campaign demonstrated a high degree of inter-APT collaboration, involving new malware tools, more than 15 dynamic link library (DLL) sideloading efforts, and novel evasion techniques. Tools and infrastructure associated with known Chinese threat actors, most notably Worok and the APT41 subgroup Earth Longzhi, were found to overlap with those used in Operation Crimson Palace. Sophos attributes the hacking activity in Operation Crimson Palace with high confidence to clusters associated with Chinese-state-sponsored activities. Despite the complexity and sophistication of the operation, it highlights that attribution alone does not necessarily predict an attacker's next moves. As the operation demonstrates, even highly skilled groups may employ completely different techniques in subsequent attacks. The Crimson Palace campaign began the following year, led by a team Sophos refers to as Cluster Alpha. This discovery underscores the increasing sophistication and coordination among advanced persistent threats (APTs) in their cyber-espionage campaigns.