The US Department of Justice (DOJ) recently unsealed an indictment against employees of the Chinese contractor I SOON for their involvement in multiple global espionage operations. Those include attacks that ESET Research previously documented in its Threat Intelligence reports and attributed to the FishMonger group — I-SOON’s operational arm — including one involving seven organisations ESET identified as being targeted in a 2022 campaign that ESET named Operation FishMedley. Alongside the indictment, the FBI (which refers to FishMonger as Aquatic Panda) added those named to its Most Wanted list. The indictment describes several attacks that are strongly related to what we published in a private APT intelligence report in early 2023. Today, ESET Research shares technical knowledge about this global campaign that targeted governments, nongovernmental organisations (NGOs), and think tanks across Asia, Europe, and the United States.
“During 2022, ESET investigated several compromises where implants such as ShadowPad and SodaMaster, which are commonly employed by China-aligned threat actors, were used. We were able to cluster seven independent incidents for Operation FishMedley,” says ESET researcher Matthieu Faou, who investigated FishMonger’s operation. “During our research, we were able to independently confirm that FishMonger is an espionage team operated by I SOON, a Chinese contractor based in Chengdu that suffered an infamous document leak in 2024.” adds Faou.
During 2022, in Operation FishMedley, FishMonger attacked governmental organisations in Taiwan and Thailand, Catholic charities in Hungary and the United States, an NGO in the United States, a geopolitical think tank in France, and an unknown organisation in Turkey. These verticals and countries are diverse, but most are of obvious interest to the Chinese government.
In most cases, the attackers seemed to have privileged access inside the local network, such as domain administrator credentials. Operators used implants, such as ShadowPad, SodaMaster, and Spyder, that are common or exclusive to China-aligned threat actors. Among other tools used by FishMonger in FishMedley are a custom password exfiltrating passwords; a tool used to interact with Dropbox, likely used to exfiltrate data from the victim’s network; the fscan network scanner; and a NetBIOS scanner.
FishMonger — a group operated by the Chinese contractor I SOON — falls under the Winnti Group umbrella and is most likely operating out of China, from the city of Chengdu, where I-SOON’s office remains likely to be located. FishMonger is also known as Earth Lusca, TAG 22, Aquatic Panda, or Red Dev 10. ESET published an analysis of this group in early 2020 when it heavily targeted universities in Hong Kong during the civic protests that started in June 2019. The group is known to operate watering-hole attacks. FishMonger’s toolset includes ShadowPad, Spyder, Cobalt Strike, FunnySwitch, SprySOCKS, and the BIOPASS RAT.
Discussion about this post