Cybersecurity experts are raising alarms about sophisticated Chinese hacking groups that are exploiting trusted cloud relationships to infiltrate corporate networks, marking a significant evolution in cyber espionage tactics.

## Murky Panda: Master of Zero-Day Exploitation

The China-linked group Murky Panda, also known as Silk Typhoon, has demonstrated exceptional skill in weaponizing both newly discovered vulnerabilities and zero-day exploits. According to CrowdStrike’s latest report, this threat actor primarily targets government, technology, academic, legal, and professional services organizations across North America.

The group gained notoriety in 2021 for exploiting zero-day vulnerabilities in Microsoft Exchange Server. Their current operations focus on intelligence gathering through a multi-pronged approach:

**Attack Methods:**
– Exploiting internet-facing appliances for initial access
– Compromising small office/home office devices as exit nodes to avoid detection
– Targeting known vulnerabilities in Citrix NetScaler and Commvault systems
– Deploying web shells and custom malware called CloudedHope

CloudedHope, a sophisticated remote access tool written in Golang, employs advanced evasion techniques including timestamp modification and evidence deletion to remain undetected.

**Cloud Trust Exploitation:**
Perhaps most concerning is Murky Panda’s abuse of trusted partnerships between organizations and their cloud providers. In late 2024, researchers observed the group compromising a supplier to gain administrative access to a victim’s Microsoft Entra ID tenant, creating backdoor accounts and targeting email systems.

## Genesis Panda: Cloud Infrastructure Manipulation

Another Chinese threat actor, Genesis Panda, has been active since January 2024, targeting financial services, media, telecommunications, and technology sectors across 11 countries. This group specializes in:

– Using cloud infrastructure for data exfiltration
– Targeting cloud service provider accounts for expanded access
– Querying Instance Metadata Services to obtain cloud credentials
– Leveraging compromised virtual machines to access deeper cloud resources

The group’s limited data exfiltration patterns suggest they may operate as an initial access broker, selling network access to other cybercriminals.

## Glacial Panda: Telecommunications Focus

The telecommunications sector has experienced a 130% increase in nation-state attacks over the past year, with Chinese group Glacial Panda leading the charge. Operating across 12 countries including the US, Japan, India, and several others, this group specifically targets:

– Call detail records and communications data
– Linux systems common in telecom infrastructure
– Legacy operating systems supporting older technologies

**Attack Techniques:**
– Exploiting known vulnerabilities and weak passwords
– Using privilege escalation exploits like Dirty COW and PwnKit
– Deploying trojanized OpenSSH components called “ShieldSlide”
– Implementing living-off-the-land techniques to avoid detection

## The Growing Cloud Threat

These developments highlight how Chinese hacking groups are becoming increasingly sophisticated in navigating cloud environments. Their focus on stealth, persistence, and exploiting trusted relationships represents a significant challenge for enterprise security teams.

Organizations must prioritize securing cloud partnerships, implementing robust access controls, and maintaining vigilant monitoring of their cloud environments to defend against these evolving threats.