The Scent of Stealth: Cyber-espionage Intrusion Analysis

ReliaQuest investigated an April–May 2023 intrusion at a manufacturing client (KILO-32325) attributed to PRC-aligned state-sponsored actors who likely gained initial access via a compromised SOHO Fortinet router and service accounts, harvested Active Directory credentials (NTDS.dit snapshot exposing >1,200 accounts and LAPS-managed local admin passwords), conducted living-off-the-land discovery and lateral movement, staged targeted R&D and operational data into passworded WinRAR archives on file servers for exfiltration, and avoided malware or C2 implants; the report documents IOCs, TTPs, impact, and recommended mitigations including edge device patching, MFA for all accounts, improved EDR/logging, and account hygiene.