China's global espionage network exposed

Cybersecurity firm ESET has uncovered Operation FishMedley, conducted by the China-linked groups FishMonger and I-SOON. The US Department of Justice has prepared an indictment against I-SOON employees for global espionage activities, while the FBI has added these individuals to its Most Wanted list. Operation FishMedley targeted governments, non-governmental organizations, and think tanks across Asia, Europe, and the US.

According to ESET, this operation was carried out by the FishMonger APT (Advanced Persistent Threat) group. I-SOON, which is believed to contribute to China's state-sponsored cyber espionage activities, focuses particularly on governments, academic institutions, and strategic targets.

FishMonger uses China-linked cyberattack tools such as ShadowPad, SodaMaster, and Spyder in its operations. According to the seized data, in 2022, Operation FishMedley targeted government agencies in Taiwan and Thailand, Catholic charities in Hungary and the US, a geopolitical think tank in France, and an unknown target in Turkey. It is believed that the attackers exfiltrated data on a large scale by gaining local administrator access to the compromised networks.

Operating out of Chengdu, China, I-SOON falls under the umbrella of the Winnti Group and is known by various names: Earth Lusca, TAG-22, Aquatic Panda, and Red Dev 10. The group is known to have targeted universities and conducted 'Watering Hole' attacks during civil protests in Hong Kong.

News Source: 12punto