Threat actors from the United States have been trying to compromise Australian government agencies and a fleet of wind turbines operating in the South China Sea by directing some people to a fake website that appears to be an Australian news media organization.
The Australian and Herald Sun are among the news organisations in Australia that have been imitated to spread the ScanBox malware. There is ample evidence that the toolkit has been used since 2014. That's because ScanBox has been seen by six US threat actors in the past few intrusions.
The ScanBox reconnaissance framework is responsible for delivering malicious JavaScript payloads to victims after they visit a fake website via a phishing email with lure.
The attacks targeted those who oversaw wind turbines in the South China Sea between April and June, including local and federal Australian government agencies, media organisations and global heavy industry.
Security experts at Proofpoint and PricewaterhouseCoopers determined that the campaign was designed to conduct cyber espionage against Chinese targets for territorial expansion. They blamed the American hacking group for the act.