Infiltration of Asian telecom networks: How cyberattackers remained undetected

Infiltrating into a network system of an enterprise has numerous benefits for attackers, such as:

• Financial data theft
• Corporate espionage
• Network control
• Profit from ransom
• Power to disrupt operations

So, imagine how much data an attacker could get by infiltrating into an enterprise network for years. This article is about a Chinese hacker group who infiltrated Asian telecom networks for four years.

What happened in the Asian telecom cyberattack?

A highly advanced cyber-espionage operation, attributed to the Chinese hacking group "Weaver Ant," infiltrated a major telecommunications provider in Asia for four years. While specific dates are not provided in the available sources, reports indicate that the intrusion was discovered and reported in March 2025.This suggests that the attack may have commenced around early 2021 or earlier.The prolonged intrusion went undetected, highlighting critical cybersecurity weaknesses within essential infrastructure.

Initial compromise and exploitation

Weaver Ant gained unauthorized access by exploiting an unpatched vulnerability in a publicly accessible application. Leveraging this security gap, they deployed a customized variant of the "China Chopper" web shell alongside a newly identified memory-resident malware known as "INMemory." By executing malicious payloads directly within system memory, they effectively minimized forensic traces, making detection extremely difficult.

Maintaining persistence and evasion tactics

Once inside, the attackers ensured persistence by disabling key security defenses. They modified Event Tracing for Windows and the Antimalware Scan Interface, effectively bypassing real-time security monitoring. Additionally, they executed Windows PowerShell commands stealthily through System.Management.Automation.dll instead of launching PowerShell.exe, further reducing visibility to security tools.

Intelligence gathering and network expansion

The primary objective of the attack was intelligence collection. The threat actors systematically mapped the internal network, targeted privileged user accounts, and accessed highly sensitive data sources, including:

• Communications metadata of influential individuals
• Government and corporate client records
• Network control systems that could enable broader surveillance

Discovery and incident response

The breach was eventually identified by the cybersecurity firm, Sygnia, during a forensic investigation. Analysts uncovered irregular system behavior that led to the detection of the attackers' web shells and memory-based malware. Successfully eliminating the threat without disrupting vital operations required close collaboration between the affected company's security team and external intelligence agencies.

What enterprise vulnerabilities do attackers typically exploit to execute a data breach?

While attackers exploited an unpatched application in this case, there are other vulnerabilities that threat actors can take advantage of, namely:

• Weak or stolen credentials: Unauthorized access is made easy for attackers by weak password policies and a lack of multi-factor authentication.
• Phishing and social engineering: Employees are tricked by cybercriminals into revealing sensitive information or clicking on malicious links, which can result in malware infections or credential theft.
• Insider threat: Disgruntled employees or careless staff can intentionally or unintentionally expose sensitive data, making internal security controls critical.
• Misconfigured cloud and network settings: Poorly secured databases, open ports, and weak access controls in cloud environments provide easy entry points for attackers.

What are the key lessons for CISOs from this attack?

The following are the key lessons:

• Proactive threat hunting is crucial since traditional security measures may not detect memory-based malware like INMemory.
• Regular patch management must be a priority since the initial breach exploited an unpatched vulnerability in a public facing application.
• APT-specific security strategies must be implemented since state-sponsored groups like Weaver Ant operate stealthily over years.
• Indirect script execution must be monitored since stealthy malware is evolving where attackers use PowerShell without PowerShell.exe, bypassing standard logging.
• Behavioral analytics must be included to detect file-less attacks just as traditional antivirus and endpoint detection tools focus on file-based malware.
• The attackers patched ETW and AMSI to evade detection. This indicates that disabling detection mechanisms must raise red flags, and monitoring for such modifications can reveal intrusions.
• Zero trust architecture is essential because strict segmentation and least privilege access constraints can help prevent lateral network movement.
• The breach was discovered by an external cybersecurity firm Syngia, demonstrating that third-party security assessments can uncover hidden threats.
• A well-practiced incident response plan is necessary to eliminate threats from a deeply embedded attack without interfering with critical operations.

What are the common attack patterns used by attackers to carry out a data breach?

Here are the top 5 patterns used by attackers:

• Phishing attacks: Attackers use deceptive emails, messages, or websites to trick users into revealing login credentials or downloading malware.
• Malware infections: Unauthorized access and data theft are accomplished using malicious software, such as trojans, spyware, or ransomware.
• SQL injection: Attackers exploit vulnerabilities in web applications to manipulate databases and extract sensitive information.
• Credential stuffing: The attackers use stolen username-password combinations from a previous breach to try and access accounts on other sites.
• Insider threats: When employees or contractors act carelessly or maliciously, they may purposefully or inadvertently jeopardize confidential information.

How to prevent data breach?

The following can be considered for data breach prevention:

• Deploy email filtering, conduct security awareness training, and enable MFA to mitigate credential theft.
• Utilize endpoint security solutions, keep software updated, and avoid downloading files from untrusted sources.
• Validate and sanitize user inputs, use prepared statements, and implement web application firewalls to prevent injection attacks.
• Require strong, unique passwords, enable MFA, and actively monitor for unauthorized login attempts.
• Restrict access based on job roles, track user activities, and provide regular cybersecurity training.
• Ensure secure communication using SSL/TLS encryption, avoid unprotected public networks, and utilize VPNs.
• Regularly update all systems, leverage threat intelligence, and use advanced detection tools to identify anomalies.
• Implement robust password policies, set up account lockout mechanisms, and integrate CAPTCHA to deter brute-force attacks.
• Protect against denial-of-service attacks with DDoS mitigation tools, apply rate limiting, and continuously monitor network traffic.
• Safeguard against cross-site scripting by filtering user inputs, enforcing Content Security Policies, and following secure coding guidelines.

Why should CISOs consider a SIEM solution to mitigate data breach?

The following are the various features of SIEM that help to enhance data breach prevention:

Key metrics to present to the board for CISOs

The following are the key metrics that can be presented by CISOs:

Related solutions