TALK: Medical Malpractice: Aggressive Collection and Meticulous Operations
Patrick Whitsell, Google GTIG
ABSTRACT
The Google Threat Intelligence Group (GTIG) discovered a sophisticated cyber-espionage campaign conducted by SOLE CASTLE, a PRC-nexus threat actor specializing in long-term, stealthy espionage utilizing novel TTPs and leveraging obfuscation networks. This presentation details our investigation into the threat actor’s deployment of a bespoke malware family, bypassing of strong authentication controls, and subsequent pivoting to "Living off the Cloud" techniques for payloadless data exfiltration. All while maintaining meticulous operations security.
We analyze INFINITERED, a custom malware framework specifically targeting a web application commonly used in the medical and scientific research community. This malware proved capable of bypassing traditional endpoint security controls by trojanizing legitimate application files, and maintained access by intercepting and modifying system upgrades.
We also discuss the threat actor’s strategy for data exfiltration leveraging legitimate cloud administration tools. This included abusing enterprise content compliance rules for stealthy keyword-based email routing of highly sensitive data. We will showcase the configurations used by SOLE CASTLE, revealing a target set including geo-political, defense, and military strategy in the JAPAC region, as well as autonomous technology and medical research.
Lastly, we highlight the collaboration of GTIG, Mandiant, FLARE, Workspace Security, and industry partners to develop a complete picture of the attack lifecycle, overcome forensic challenges encountered, and deploy our disruption strategy against these campaigns. We provide a thorough outline of SOLE CASTLE’s campaign and showcase our defense strategies for identifying and mitigating stealthy cloud-based exfiltration.
Patrick Whitsell
Patrick is a Sr. Security Engineer with the Google Threat Intelligence Group (GTIG) where he dedicates his expertise to defending against cyber espionage threat actors to protect Google, its users and customers, and the broader internet community. With over a decade of experience in cybersecurity, he has spent the last 5 years researching cyber threats with GTIG and the Threat Analysis Group.
