Chinese UNC6384 Hackers Use Valid Code-Signing Certificates to Evade Detection

The article discusses a cyber espionage operation attributed to the Chinese threat actor group UNC6384, linked to TEMP.Hex. This operation targets diplomats in Southeast Asia and global entities using advanced tactics like adversary-in-the-middle attacks and digitally signed malware. The attackers hijack web traffic to redirect victims to malicious sites, deploying the SOGU.SEC backdoor for persistent access and data exfiltration.

The campaign utilizes valid code-signing certificates to evade detection, highlighting the groupundefineds sophisticated capabilities. Google has responded by issuing alerts and enhancing security measures, urging defenders to implement protective strategies.