Computer espionage definition windows#

The attacker can also start arbitrary processes and interact with them. Daxin in detailĭaxin is a backdoor that allows the attacker to perform various operations on the infected computer such as reading and writing arbitrary files.

This use case has been optimized by Daxin’s designers.ĭaxin also features network tunneling, allowing attackers to communicate with legitimate services on the victim’s network that can be reached from any infected computer.

The attackers can select an arbitrary path across infected computers and send a single command that instructs these computers to establish requested connectivity. Instead, it can abuse any legitimate services already running on the infected computers.ĭaxin is also capable of relaying its communications across a network of infected computers within the attacked organization. Specifically, the malware avoids starting its own network services. These features are reminiscent of Regin, an advanced espionage tool discovered by Symantec in 2014 that others have linked to Western intelligence services.ĭaxin’s capabilities suggest the attackers invested significant effort into developing communication techniques that can blend in unseen with normal network traffic on the target’s network. It implements advanced communications functionality, which both provides a high degree of stealth and permits the attackers to communicate with infected computers on highly secured networks, where direct internet connectivity is not available.

Computer espionage definition windows#

Daxin technical overviewĪs described in more detail below, Daxin comes in the form of a Windows kernel driver, a relatively rare format for malware nowadays. This blog provides an overview of Daxin’s capabilities and will be followed with additional blogs providing further in-depth analysis. Through Broadcom’s membership in the Joint Cyber Defense Collaborative (JCDC), Symantec researchers worked with the Cyber Security and Infrastructure Security Agency (CISA) to engage with multiple foreign governments targeted with Daxin and assisted in detection and remediation. Considering its capabilities and the nature of its deployed attacks, Daxin appears to be optimized for use against hardened targets, allowing the attackers to burrow deep into a target’s network and exfiltrate data without raising suspicions. In addition, other tools associated with Chinese espionage actors were found on some of the same computers where Daxin was deployed.ĭaxin is without doubt the most advanced piece of malware Symantec researchers have seen used by a China-linked actor. Most of the targets appear to be organizations and governments of strategic interest to China. There is strong evidence to suggest the malware, Backdoor.Daxin, which allows the attacker to perform various communications and data-gathering operations on the infected computer, has been used as recently as November 2021 by attackers linked to China. The malware appears to be used in a long-running espionage campaign against select governments and other critical infrastructure targets. New research by the Symantec Threat Hunter team, part of Broadcom Software, has uncovered a highly sophisticated piece of malware being used by China-linked threat actors, exhibiting technical complexity previously unseen by such actors.