Government, Industrial Servers Targeted in China-Linked ‘PassiveNeuron’ Campaign

SecurityWeek reports that a China-linked threat actor has been targeting high-profile government, finance, and industrial organisations across Asia, Africa and Latin America with multiple implants as part of the PassiveNeuron campaign, which has been active for at least two years. According to Kaspersky, the operation focuses on Windows Server machines to gain remote code execution for deploying web shells and subsequent implants, including Neursite, NeuralExecutor, and the Cobalt Strike framework.

The DLL loaders are typically placed in the System32 directory to achieve persistence and automatic startup, with each implant exceeding 100 MB to help evade detection. Neursite and NeuralExecutor support multiple command-and-control methods, and Neursite can retrieve system information, manage processes, proxy traffic, load additional plugins, and execute shell commands.

Recent samples reportedly obtain C2 addresses from GitHub, and a PDB string in one DLL points to APT41, which led researchers to attribute the campaign to a Chinese-speaking APT, though claims about attribution remain.