Chinese APT Uses ‘Airstalk’ Malware in Supply Chain Attacks

According to Palo Alto Networks, a suspected Chinese state-sponsored threat actor has deployed an AirWatch API-abusing malware family in supply chain attacks, with two variants of a malware dubbed Airstalk seen—one written in PowerShell and the other in .NET. The APT, tracked as CL-STA-1009, has focused on business process outsourcing entities to access clients’ networks via their gateways.

Both variants use the AirWatch mobile device management API to establish a covert command-and-control channel, employ a multi-threaded communication protocol, and are signed with likely stolen certificates. The PowerShell version can be commanded to take screenshots, list files in the user directory, enumerate Chrome profiles, and harvest Chrome data such as cookies, bookmarks, and history, while the .NET variant targets Microsoft Edge and Island Browser and can open URLs in Chrome.

Palo Alto Networks notes that CL-STA-1009 is a threat activity cluster representing activity from a suspected nation-state actor, associated with Airstalk malware in supply chain attacks.