China​​ 

Insikt Group® researchers used proprietary Recorded Future Network Traffic Analysis and RAT controller detections, along with common analytical techniques, to identify and profile a cyberespionage campaign attributed to a suspected Chinese state-sponsored threat activity group, which we are tracking as RedDelta.​​ 

Data sources include the Recorded Future® Platform, Farsight Security’s DNSDB, SecurityTrails, VirusTotal, Shodan, BinaryEdge, and common OSINT techniques.​​ 

This report will be of greatest interest to network defenders of private sector, public sector, and non-governmental organizations with a presence in Asia, as well as those interested in Chinese geopolitics.​​ 

Executive Summary​​ 

From early May 2020, The Vatican and the Catholic Diocese of Hong Kong were among several Catholic Church-related organizations that were targeted by RedDelta, a Chinese-state sponsored threat activity group tracked by Insikt Group. This series of suspected network intrusions also targeted the Hong Kong Study Mission to China and the Pontifical Institute for Foreign Missions (PIME), Italy. These organizations have not been publicly reported as targets of Chinese threat activity groups prior to this campaign.​​ 

These network intrusions occured ahead of the anticipated September 2020 renewal of the landmark 2018 China-Vatican provisional agreement, a deal which reportedly resulted in the Chinese Communist Party (CCP) gaining more control and oversight over the country’s historically persecuted “underground” Catholic community. In addition to the Holy See itself, another likely target of the campaign includes the current head of the Hong Kong Study Mission to China, whose predecessor was considered to have played a vital role in the 2018 agreement.​​ 

The suspected intrusion into the Vatican would offer RedDelta insight into the negotiating position of the Holy See ahead of the deal’s September 2020 renewal. The targeting of the Hong Kong Study Mission and its Catholic Diocese could also provide a valuable intelligence source for both monitoring the diocese’s relations with the Vatican and its position on Hong Kong’s pro-democracy movement amidst widespread protests and the recent sweeping Hong Kong national security law.​​ 

While there is considerable overlap between the observed TTPs of RedDelta and the threat activity group publicly referred to as Mustang Panda (also known as BRONZE PRESIDENT and HoneyMyte), there are a few notable distinctions which lead us to designate this activity as RedDelta:​​ 

• The version of PlugX used by RedDelta in this campaign uses a different C2 traffic encryption method and has a different configuration encryption mechanism than traditional PlugX.​​ 
• The malware infection chain employed in this campaign has not been publicly reported as used by Mustang Panda.​​ 

In addition to the targeting of entities related to the Catholic Church, Insikt Group also identified RedDelta targeting law enforcement and government entities in India and a government organization in Indonesia.​​ 

Figure 1: Selection of main differences between PlugX variants and the infection chain used by RedDelta and Mustang Panda.​​ 

Key Judgments​​ 

• Es probable que la persecución de entidades relacionadas con la Iglesia Católica sea indicativa de los objetivos del Partido Comunista Chino (PCCh) de consolidar el control sobre la Iglesia Católica "clandestina", "sinizar las religiones " en China y disminuir la influencia percibida del Vaticano dentro de la comunidad católica china.​​ 
• Due to RedDelta’s targeting of organizations that heavily align to Chinese strategic interests, use of shared tooling traditionally used by China-based groups, and overlaps with a suspected Chinese state-sponsored threat activity group, Insikt Group believes that the group likely operates on behalf of the People’s Republic of China (PRC) government.​​ 
• The identified RedDelta intrusions feature infrastructure, tooling, and victimology overlap with the threat activity group publicly reported as Mustang Panda (also known as BRONZE PRESIDENT and HoneyMyte). This includes the use of overlapping network infrastructure and similar victimology previously attributed to this group in public reporting, as well as using malware typically used by Mustang Panda, such as PlugX, Poison Ivy, and Cobalt Strike.​​ 

Background​​ 

China and the Catholic Church​​ 

For many years, Chinese state-sponsored groups have targeted religious minorities within the the PRC, particularly those within the so-called “Five Poisons,” such as Tibetan, Falun Gong, and Uighur muslim communities. Insikt Group has publicly reported on aspects of this activity, such as our findings on RedAlpha, the ext4 backdoor, and Scanbox watering hole campaigns targeting the Central Tibetan Administration, other Tibetan entities, and the Turkistan Islamic Party. Most recently, a July 2020 U.S. indictment identified the targeting of emails belonging to Chinese Christian religious figures — a Xi’an-based pastor, as well as an underground church pastor in Chengdu, the latter of whom was later arrested by the PRC government, by two contractors allegedly operating on behalf of the Chinese Ministry of State Security (MSS). Regional branches of China’s Ministry of Public Security (MPS) have also been heavily involved in digital surveillance of ethnic and religious minorities within the PRC, most notably by the Xinjiang Public Security Bureau (XPSB) in the case of Uighur muslims.​​ 

Historically, the PRC has had a highly turbulent relationship with the Vatican and its governing body, the Holy See. In particular, the Holy See’s recognition of bishops within China’s historically persecuted “underground” Catholic church traditionally loyal to the Vatican and its relationship with Taiwan has maintained an absence of official relations since the 1950s. The CCP perceived this behavior as the Holy See interfering in religious matters within China. In September 2018, the PRC and the Holy See reached a landmark two-year provisional agreement, marking a significant step towards renewed diplomatic relations.​​ 

Under the provisional agreement, China would regain more control over underground churches, and the Vatican in turn would gain increased influence over the appointment of bishops within the state-backed “official” Catholic church. The deal was met with a mixed reaction, with critics arguing that the deal was a betrayal of the underground church and would lead to increased persecution of its members. Many of the harshest criticisms came from clergy within Hong Kong. A year after the agreement, numerous reports noted the Vatican’s silence in response to the Hong Kong protests beginning in late 2019, in what critics called an effort to avoid offending Beijing and jeopardizing the 2018 agreement.​​ 

Threat Analysis​​ 

Overview of Catholic Church Intrusions​​ 

Figure 2: Intelligence Card for RedDelta PlugX C2 Server 167.88.180[.]5.​​ 

Using Recorded Future RAT controller detections and network traffic analysis techniques, Insikt Group identified multiple PlugX C2 servers communicating with Vatican hosts from mid-May until at least July 21, 2020. Concurrently, we identified Poison Ivy and Cobalt Strike Beacon C2 infrastructure also communicating with Vatican hosts, a Vatican-themed phishing lure delivering PlugX, and the targeting of other entities associated with the Catholic Church.​​ 

Figure 3: Vatican lure document targeting the head of Hong Kong study mission to China.​​ 

El documento de señuelo en la Figura 3, que ya se informó previamente en relación con los enlaces con la selección de la Iglesia Católica de Hong Kong, se empleó para entregar una carga útil PlugX personalizada que se comunicaba con el sistema de dominio C2com. El documento pretendía ser una carta oficial del Vaticano dirigida al actual jefe de la Misión de Estudio de Hong Kong en China. Actualmente no está claro si los actores crearon el documento ellos mismos o si es un documento legítimo que pudieron obtener y convertir en arma. Dado que la carta estaba dirigida directamente a esta persona, es probable que fuera objetivo de un intento de spearphishing. Además, dado que esta muestra fue recopilada tras señales de una intrusión en la red del Vaticano, también es posible que el señuelo de phishing se enviara a través de una cuenta del Vaticano comprometida. Esta hipótesis se apoya en la identificación de comunicaciones entre los C2 de PlugX y un servidor de correo vaticano en los días que rodean la fecha de compilación de la muestra y su primera presentación a repositorios públicos de malware.​​ 

The head of the Hong Kong Study Mission is considered the Pope’s de facto representative to China and a key link between Beijing and the Vatican. The predecessor to this role played a key part in the finalization of the 2018 provisional China-Vatican agreement, making his successor a valuable target for intelligence gathering ahead of the deal’s expiry and likely renewal in September 2020.​​ 

Further entities associated with the Catholic Church were also targeted by RedDelta in June and July 2020 using PlugX, including the mail servers of an international missionary center based in Italy and the Catholic Diocese of Hong Kong.​​ 

Figure 4: Union of Catholic Asian News article lure document (left), and Qum, the Vatican of Islam lure document (right).​​ 

Insikt Group identificó dos señuelos de phishing adicionales que cargaban la misma variante personalizada de PlugX, ambos comunicados con la misma infraestructura C2 que el señuelo vaticano. La primera muestra incluía un documento señuelo que parodia un boletín de noticias de la Unión de Noticias Católicas Asiáticas sobre la inminente introducción de la nueva ley de seguridad nacional de Hong Kong. El contenido del archivo de señuelo, titulado "Sobre el plan de China para la law.doc de seguridad en Hong Kong", fue tomado de un artículo legítimo de la Union of Catholic Asian News. El otro ejemplo también hace referencia al Vaticano usando un documento titulado "QUM, IL VATICANO DELL'ISLAM.doc" para el documento señuelo. Este documento señuelo en individuo se traduce como "Qum, el Vaticano del Islam", referir a la ciudad iraní de Qum (Qom), un importante centro político y religioso chií. Está tomada de los escritos de Franco Ometto, un académico católico italiano que vive en Irán. Aunque el objetivo directo de estos dos señuelos no está claro, ambos están relacionados con la Iglesia Católica.​​ 

Creemos que este objetivo es indicativo tanto del objetivo de China de consolidar un mayor control sobre la Iglesia católica clandestina dentro de China como de disminuir la influencia percibida del Vaticano sobre los católicos chinos. De manera similar, centrar en los católicos de Hong Kong en medio de protestas prodemocráticas y la reciente amplia ley de seguridad nacional está en línea con los intereses estratégicos chinos, especialmente dada la postura anti-Pekín de muchos de sus miembros, incluido el exobispo de Hong Kong, el cardenal Joseph Zen Ze-kiun.​​ 

Outlook​​ 

Our research uncovered a suspected China state-sponsored campaign targeting multiple high-profile entities associated with the Catholic Church ahead of the likely renewal of the provisional China-Vatican deal in September 2020. The CCP’s warming diplomatic relations with the Holy See has been commonly interpreted as a means to facilitate increased oversight and control over its unofficial Catholic church. This also supports the CCP’s wider stated goal of “sinicizing religions” in China. Furthermore, it demonstrates that China’s interest in control and surveillance of religious minorities is not confined to those within the “Five Poisons,” exemplified by the continued persecution and detainment of underground church members and allegations of physical surveillance of official Catholic and Protestant churches.​​ 

El Embajador Especial de Estados Unidos para la Libertad Religiosa Internacional expresó recientemente su preocupación por el impacto de la nueva ley de seguridad nacional en Hong Kong, afirmando que tiene el "potencial de socavar significativamente la libertad religiosa". El objetivo de la diócesis católica de Hong Kong es probablemente una valiosa fuente de inteligencia tanto para monitorizar la posición de la diócesis sobre el movimiento prodemocrático de Hong Kong como para sus relaciones con el Vaticano. Esto marca un posible precursor de un aumento de los límites a la libertad religiosa dentro de la región administrativa especial, especialmente cuando coincide con posturas prodemocracia o anti-Pekín.​​ 

RedDelta is a highly active threat activity group targeting entities relevant to Chinese strategic interests. Despite the group’s consistent use of well-known tools such as PlugX and Cobalt Strike, infrastructure reuse, and operations security failures, these intrusions indicate RedDelta is still being tasked to satisfy intelligence requirements. In particular, this campaign demonstrates a clear objective to target religious bodies, and therefore we feel this is particularly pertinent for religious and non-governmental organizations (NGOs) to take note and invest in network defenses to counter the threat posed by Chinese state-sponsored threat activity groups like RedDelta. A lack of ability to invest in security and detection measures for many NGOs and religious organizations greatly increases the likelihood of success for well-resourced and persistent groups, even using well-documented tools, TTPs, and infrastructure.​​ 

Network Defense Recommendations​​ 

Recorded Future recommends that users conduct the following measures to detect and mitigate activity associated with RedDelta activity:​​ 

• Configure your intrusion detection systems (IDS), intrusion prevention systems (IPS), or any network defense mechanisms in place to alert on — and upon review, consider blocking illicit connection attempts from — the external IP addresses and domains listed in the appendix.​​ 

Additionally, we advise organizations to follow the following general information security best practice guidelines:​​ 

• Keep all software and applications up to date; in particular, operating systems, antivirus software, and core system utilities.​​ 
• Filter email correspondence and scrutinize attachments for malware.​​ 
• Make regular backups of your system and store the backups offline, preferably offsite so that data cannot be accessed via the network.​​ 
• Have a well-thought-out incident response and communications plan.​​ 
• Adhere to strict compartmentalization of company-sensitive data. In particular, look at which data anyone with access to an employee account or device would have access to (for example, through device or account takeover via phishing).​​ 
• Strongly consider instituting role-based access, limiting company-wide data access, and restricting access to sensitive data.​​ 
• Employ host-based controls; one of the best defenses and warning signals to thwart attacks is to conduct client-based host logging and intrusion detection capabilities.​​ 
• Implement basic incident response and detection deployments and controls like network IDS, netflow collection, host logging, and web proxy, alongside human monitoring of detection sources.​​ 
• Be aware of partner or supply chain security standards. Being able to monitor and enforce security standards for ecosystem partners is an important part of any organization’s security posture.​​ 

Nota del editor: Esta publicación fue un extracto de un reporte completo. Para leer el análisis completo,​​  Haz clic aquí​​  to download the report as a PDF.​​