Gaming the system: how a Chinese-speaking actor turned Brazilian government sites into an SEO weapon

MITRE Techniques

• [T1105 ] Ingress Tool Transfer – The actors download and deploy custom components and payloads onto victim systems, including Apache module source and Linux toolkit binaries (‘It downloads the module’s C source, opsproxy.c, from a hardcoded staging server’ / ‘it downloads a file to /usr/bin/chuser’).
• [T1059.004 ] Command and Scripting Interpreter: Unix Shell – Bash scripts and shell commands are used for installation, execution, and administration of malware (‘via a Bash installer’ / ‘runs it with /bin/sh -c’).
• [T1505.003 ] Server Software Component: Web Shell – Malicious Apache modules are installed on web servers to inject or relay attacker content (‘compile and install malicious Apache modules’ / ‘a purpose-built reverse proxy’).
• [T1090.002 ] Proxy: External Proxy – Compromised servers act as stealth reverse proxies that forward visitors to phishing pages (‘silently reverse-proxy visitors to attacker-controlled phishing pages’).
• [T1027 ] Obfuscated Files or Information – Malware and scripts are heavily obfuscated with packing, virtualization, encryption, and RC4/AES-GCM protection (‘wrapped in packing and virtualization layers’ / ‘decrypts it with RC4’ / ‘AES-GCM encrypted’).
• [T1036 ] Masquerading – Tools disguise themselves as legitimate binaries, services, or system components (‘systemd-udevd’, ‘xtables-addons’, ‘sshd: root@pts/0’).
• [T1070.006 ] File and Directory Discovery: Timestomp – The module and payloads timestomp files to match legitimate Apache components (‘timestomps the resulting .so and its load-configuration files’).
• [T1016 ] System Network Configuration Discovery – Reconnaissance scripts and agents enumerate network interfaces, ARP neighbors, listening ports, and IPs (‘gathers classic lateral-movement intelligence’ / ‘interface addresses’ / ‘local listening TCP ports’).
• [T1046 ] Network Service Discovery – The cam-agent, nuclei, naabu, and related tools scan hosts, ports, and services (‘takes IPs or hostnames, port ranges’ / ‘portscan’).
• [T1110.001 ] Brute Force: Password Guessing – The BruteForcer utility attempts SSH logins with supplied usernames and passwords (‘attempts concurrent SSH logins’).
• [T1056.001 ] Input Capture: Keylogging – PasswordHarvester intercepts credentials by attaching to authentication programs and reading credential buffers (‘monitors newly executed authentication programs’ / ‘reads the credential buffers’).
• [T1021.004 ] Remote Services: SSH – The malware targets SSH sessions and also provides an embedded SSH server for operator access (‘sshd’, ‘ssh sessions’ / ’embedded SSH server’).
• [T1098 ] Account Manipulation – ChUser and setuid helper behavior support privileged access and persistence (‘turning it into a setuid helper that serves as a persistent local privilege-escalation backdoor’).
• [T1070.004 ] Indicator Removal: File Deletion – Installer scripts remove source and build artifacts after deployment (‘the script deletes the source and all build artifacts’).
• [T1070.001 ] Indicator Removal: Clear Windows Event Logs – The group suppresses traces through logging redirection and cleanup-like behavior on Linux (‘writes to /dev/null’ / ‘redirecting stdout and stderr to a file’ / ‘deletes its original on-disk copy’).
• [T1095 ] Non-Application Layer Protocol – The agent uses DNS and gRPC tunnels as alternate communication channels (‘commands travel inside DNS queries’ / ‘gRPC over HTTPS’).
• [T1071.001 ] Application Layer Protocol: Web Protocols – C2 and payload traffic are hidden inside HTTPS and HTTP-like web traffic (‘gRPC over HTTPS’ / ‘plain HTTP connection’).
• [T1132.001 ] Data Encoding: Standard Encoding – Jobs are Base32/Base64-encoded before transport in DNS and C2 channels (‘encrypted, Base32-encoded’ / ‘RC4-encrypted and Base64-encoded’).
• [T1112 ] Modify Registry or Configuration – The actors alter security-relevant configuration on Linux systems, including Apache settings, SELinux, and service entries (‘disables SELinux enforcement’ / ‘wires the module into the server’s configuration’).
• [T1204.002 ] User Execution: Malicious File – Payloads are executed after being downloaded and staged on the host (‘downloads a file … and executes it’).
• [T1562.001 ] Impair Defenses: Disable or Modify Tools – The Apache module strips CSP headers and oRAT disables SELinux to weaken defenses (‘strips the upstream site’s Content-Security-Policy headers’ / ‘disables SELinux enforcement’).
• [T1018 ] Remote System Discovery – The tools enumerate hosts, domains, users, and services across environments (‘hostname, users, running services, active network connections’).
• [T1021.001 ] Remote Services: Remote Desktop Protocol – No direct RDP is mentioned; not applicable.
• [T1219 ] Remote Access Software – AlphaAgent and oRAT function as remote access backdoors with shells, file transfer, tunneling, and proxying (‘remote shell and interactive terminal’ / ‘REST-style routes’ / ‘proxyOpen a SOCKS proxy’).