MalwarePublished 30 Aug 2022

Watering Hole Attacks Push ScanBox Keylogger

Source Threatpost

javascript

Description

A China-based advanced persistent threat (APT) group TA423, also known as Red Ladon, conducted watering hole attacks using the ScanBox JavaScript-based reconnaissance tool. The attacks targeted domestic Australian organizations and offshore energy firms in the South China Sea region by compromising websites that appeared as legitimate news sources. ScanBox operates as a keylogger embedded in JavaScript, enabling covert data collection without installing malware on victim systems. The campaign ran from April to mid-June 2022 and leveraged phishing emails to lure victims to compromised sites. ScanBox collects detailed browser and system information, including browser extensions and network details, facilitating further targeted espionage activities. The threat actor is linked to the Chinese Ministry of State Security and focuses on intelligence gathering related to geopolitical interests in the South China Sea and beyond.

Impact

The ScanBox framework enables attackers to covertly collect sensitive information such as keystrokes, browser and system fingerprinting data, and network details from victims without deploying traditional malware. This facilitates espionage and intelligence gathering, potentially exposing confidential communications and user credentials. The use of watering hole attacks increases the risk of compromise for users visiting trusted websites. The campaign's targeting of strategic sectors and regions indicates a focused espionage effort with potential national security implications.

Defensive guidance

Defenders should ensure robust email filtering to block phishing attempts and monitor for suspicious website redirects. Organizations should educate users about the risks of clicking unsolicited links and visiting untrusted sites. Web filtering and endpoint security solutions that detect and block malicious JavaScript may help reduce exposure. Since this is an espionage campaign leveraging watering hole attacks, maintaining updated threat intelligence and monitoring for indicators of compromise related to TA423 activity is recommended.

Summary

Researchers identified a watering hole attack campaign attributed with moderate confidence to the China-based APT TA423 (Red Ladon). The attackers used phishing emails to direct targets to compromised websites mimicking Australian news outlets, where the ScanBox JavaScript framework was deployed. ScanBox is a reconnaissance tool that acts as a keylogger by executing JavaScript in the victim's browser, capturing keystrokes and system/browser fingerprinting data without requiring malware installation on disk. It leverages WebRTC and STUN protocols to gather network information and maintain communication even behind NAT devices. The campaign targeted organizations in Australia and offshore energy sectors in the South China Sea, with the broader objective of intelligence gathering related to regional geopolitical tensions. TA423 is linked to the Chinese Ministry of State Security and has a history of cyber espionage targeting multiple industries globally.

References

threatpost.com/watering-hole-attacks-push-scanbox-keylogger/180490/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 4 Aug 2026, 12:42 UTC

References

Community reviews

Related threats