Silk Typhoon hackers hijack network captive portals in diplomat attacks

According to Google Threat Intelligence Group, Silk Typhoon-linked actors targeted diplomats by hijacking network captive portals using an advanced AitM technique to redirect traffic to a malware-serving landing page. The campaign begins when the Chrome browser checks for a captive portal, with victims then prompted to download a digitally signed AdobePlugins.exe, which installs a disguised MSI package containing a Canon printer tool and a backdoor.

The final payload is loaded in memory via a DLL side-loading technique, with SOGU[.]SEC—a backdoor variant associated with PlugX—providing a remote shell and the ability to gather system information and transfer files. GTIG tracks UNC6384, and notes this activity may be connected to the Chinese threat actor TEMP[.]Hex, also known as Mustang Panda and Silk Typhoon, with at least 25 malware samples signed by Chengdu Nuoxin Times Technology Co., Ltd observed since early 2023.

Google blocked the malicious domains and file hashes via Safe Browsing, and issued government-backed attacker alerts to affected Gmail and Workspace users, while releasing YARA rules to detect STATICPLUGIN and CANONSTAGER and IoCs for the sampled files. The campaign illustrates the growing sophistication of Chinese-nexus espionage groups and their propensity to switch infrastructure and binary builds quickly.