On Friday, the U.S. Department of Justice issued a correction to a prior statement: several U.S. government agencies — including NASA, the Federal Reserve, the Department of Energy, and the DoJ itself — were targets of attacks attributed to Chinese threat actors, not confirmed victims. That distinction matters enormously, and it's one every SOC and IR team should internalize.
The correction signals two things. First, federal investigators have visibility into active, ongoing China-nexus reconnaissance and intrusion attempts against some of the most hardened networks in the world. Second, even the DoJ initially conflated targeting with compromise — a classification error that happens in private-sector incident response every single week. If the organizations being aimed at include the Federal Reserve and the Department of Energy, your organization is almost certainly in the same target set or in the supply chain of someone who is.
This post breaks down what the correction actually tells us, why the target-vs-victim distinction should change how you scope incidents, and how to hunt for the tradecraft China-nexus actors consistently use when they move from targeting to intrusion.
Technical Analysis
What we know
- Attribution: Chinese threat actors (per DoJ statements). China-nexus state-sponsored groups — including clusters tracked by industry as APT41, Volt Typhoon, Salt Typhoon, and related contractors — have a well-documented pattern of targeting U.S. government, critical infrastructure, and legal/regulatory bodies for espionage and pre-positioning.
- Target set: NASA, the Federal Reserve, the Department of Energy, and the Department of Justice, among others. This spans space/research, financial systems, energy, and law enforcement — a classic espionage and strategic pre-positioning collection set.
- Victim status: The DoJ's correction states these agencies were among those targeted. There is no public confirmation of successful compromise of these specific agencies in this statement.
No CVE was disclosed in connection with this reporting, and defenders should not assume one. Recent China-nexus campaigns have overwhelmingly relied on edge-device exploitation, valid account abuse, and living-off-the-land techniques rather than novel malware — precisely because those approaches minimize forensic footprint.
Why "targeted, not victim" is an operational distinction
In IR scoping, I see this confusion constantly. A client sees a blocked exploit attempt in firewall logs, or their name in a threat actor's target list, and leadership declares a breach. The DoJ correction is a masterclass in disciplined classification:
- Targeted: Reconnaissance, scanning, exploit attempts, phishing delivery, or credential probing directed at the organization. Observable at the perimeter. No evidence of successful execution or access.
- Victim (compromised): Confirmed unauthorized access, persistence, data staging, or command-and-control. Requires evidence of execution inside the trust boundary.
The investigative gap between the two is where your SOC earns its budget. Every targeting event against a high-value organization should trigger a compromise assessment — not a press release, and not a shrug. The question is never "were we attacked?" (you were) but "did any attempt succeed, and how would we know?"
The tradecraft to expect
Based on the consistent, publicly documented playbook of China-nexus state actors against U.S. federal targets, compromise assessments should prioritize:
- Edge and remote-access infrastructure — VPN concentrators, firewalls, email gateways, and remote desktop services. These actors favor exploiting perimeter devices because they sit outside EDR visibility.
- Webshells on internet-facing IIS/Exchange and Java application servers — the canonical persistence mechanism when a perimeter web service is breached.
- Living-off-the-land execution —
rundll32,wmic,powershell,net,nltest, andvssadminlaunched from web server or VPN contexts to blend with admin activity. - Credential theft and valid account use — NTDS.dit access, LSASS access from unusual processes, and Kerberos anomalies enabling lateral movement without malware.
- Log tampering and timestomping — these actors are disciplined about anti-forensics; absence of logs is itself an indicator.
Detection & Response
The detections below target the observable behaviors most likely to differentiate "targeted" from "compromised" when a perimeter web or remote-access service is probed by a state actor. They are tuned for high-signal environments; baseline before deploying broadly.
Sigma Rules
---
title: Web Server Process Spawning Command Shell or Recon Tool
id: 3f8c2a41-7b1e-4d59-9a02-6c5e8f1a2b3d
status: experimental
description: Detects IIS worker processes or common web server processes spawning command shells or discovery utilities, a hallmark of webshell activity following perimeter exploitation by nation-state actors.
references:
- https://attack.mitre.org/techniques/T1505/003/
- https://attack.mitre.org/techniques/T1059/001/
author: Security Arsenal
date: 2026/08/10
tags:
- attack.persistence
- attack.t1505.003
- attack.execution
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- '\w3wp.exe'
- '\httpd.exe'
- '\nginx.exe'
- '\tomcat9.exe'
- '\java.exe'
selection_child:
Image|endswith:
- '\cmd.exe'
- '\powershell.exe'
- '\pwsh.exe'
- '\net.exe'
- '\net1.exe'
- '\whoami.exe'
- '\nltest.exe'
- '\ipconfig.exe'
- '\certutil.exe'
- '\wmic.exe'
condition: selection_parent and selection_child
falsepositives:
- Web applications that legitimately shell out to system utilities (rare; inventory and exclude by application pool identity)
- Content management or monitoring plugins executing health checks
level: high
---
title: Webshell File Creation in Web Server Content Directories
id: 9d4e7b12-3c6a-4f88-b571-2a9d0c4e6f81
status: experimental
description: Detects creation of script files (ASPX, ASP, PHP, JSP) in web content directories by non-standard processes, consistent with webshell deployment during perimeter compromise.
references:
- https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/08/10
tags:
- attack.persistence
- attack.t1505.003
logsource:
category: file_event
product: windows
detection:
selection_path:
TargetFilename|contains:
- '\inetpub\wwwroot\'
- '\wwwroot\'
- '\htdocs\'
- '\webapps\'
selection_ext:
TargetFilename|endswith:
- '.aspx'
- '.asp'
- '.ashx'
- '.php'
- '.jsp'
- '.jspx'
filter_deploy:
Image|endswith:
- '\devenv.exe'
- '\MSBuild.exe'
- '\w3wp.exe'
- '\Robocopy.exe'
- '\xcopy.exe'
condition: selection_path and selection_ext and not filter_deploy
falsepositives:
- Legitimate web deployments outside CI/CD tooling — scope exclusions to your known deployment accounts and paths
level: high
---
title: LSASS Memory Access by Uncommon Process
id: 5c1a9f33-8e2d-4b64-a7c9-1f3d6e8b0a42
status: experimental
description: Detects processes outside the standard allowlist accessing LSASS memory, indicative of credential dumping frequently observed in nation-state intrusions after initial access.
references:
- https://attack.mitre.org/techniques/T1003/001/
author: Security Arsenal
date: 2026/08/10
tags:
- attack.credential_access
- attack.t1003.001
logsource:
category: process_access
product: windows
detection:
selection:
TargetImage|endswith: '\lsass.exe'
GrantedAccess|contains:
- '0x1010'
- '0x1410'
- '0x1438'
- '0x143a'
- '0x1fffff'
filter_legit:
SourceImage|endswith:
- '\MsMpEng.exe'
- '\wininit.exe'
- '\svchost.exe'
- '\csrss.exe'
condition: selection and not filter_legit
falsepositives:
- EDR, backup, and identity-protection agents accessing LSASS — build an environment-specific allowlist before enabling at high level
level: high
KQL — Microsoft Sentinel / Defender
This query hunts for web server processes spawning reconnaissance or shell tooling, then pivots to outbound network connections from those same hosts within the following hour — the pattern that separates a blocked attempt (targeted) from a live intrusion (victim):
let Lookback = 7d;
let WebParents = dynamic(["w3wp.exe", "httpd.exe", "nginx.exe", "tomcat9.exe", "java.exe"]);
let SuspiciousChildren = dynamic(["cmd.exe", "powershell.exe", "pwsh.exe", "net.exe", "whoami.exe", "nltest.exe", "certutil.exe", "wmic.exe", "vssadmin.exe"]);
let SuspectHosts =
DeviceProcessEvents
| where TimeGenerated > ago(Lookback)
| where InitiatingProcessFileName in~ (WebParents)
| where FileName in~ (SuspiciousChildren)
| project HostName = DeviceName, FirstSeen = TimeGenerated, InitiatingProcessFileName, FileName, ProcessCommandLine, AccountName;
SuspectHosts
| join kind=leftouter (
DeviceNetworkEvents
| where TimeGenerated > ago(Lookback)
| where RemoteIP !startswith "10." and RemoteIP !startswith "192.168." and RemoteIP !startswith "172.16."
| project HostName = DeviceName, ConnTime = TimeGenerated, RemoteIP, RemoteUrl, RemotePort, InitiatingProcessFileName2 = InitiatingProcessFileName
) on HostName
| where ConnTime between (FirstSeen .. FirstSeen + 1h)
| project HostName, FirstSeen, InitiatingProcessFileName, FileName, ProcessCommandLine, AccountName, RemoteIP, RemoteUrl, RemotePort
| order by FirstSeen desc
For organizations ingesting firewall/VPN logs into Sentinel (critical for edge-device visibility where EDR cannot see), hunt for exploitation attempts against remote-access services followed by any successful authentication from the same source:
let Lookback = 14d;
let ExploitSources =
CommonSecurityLog
| where TimeGenerated > ago(Lookback)
| where DeviceVendor has_any ("Fortinet", "Palo Alto", "Cisco", "Citrix", "Ivanti", "SonicWall", "F5")
| where DeviceAction in~ ("blocked", "deny", "denied", "drop", "alert")
| where Message has_any ("exploit", "traversal", "injection", "webshell", "rce") or DeviceEventClassID has_any ("exploit", "attack")
| summarize AttemptCount = count() by SourceIP, DestinationIP, DeviceProduct;
ExploitSources
| join kind=inner (
CommonSecurityLog
| where TimeGenerated > ago(Lookback)
| where DeviceAction in~ ("allow", "accept", "permit") or Message has_any ("login success", "authenticated", "session established")
| project AuthTime = TimeGenerated, SourceIP, DestinationUserName, DeviceProduct
) on SourceIP
| project SourceIP, AttemptCount, EdgeDevice = DeviceProduct, AuthTime, DestinationUserName
| order by AttemptCount desc
That second query is the analytical core of the DoJ's distinction: exploit attempts from a source are targeting; a successful authentication or session from that same source is a compromise indicator demanding full IR scoping.
Velociraptor VQL
Hunt across the fleet for webshell artifacts in web content directories and suspicious child processes of web servers:
-- Hunt for recently created script files in web content directories
-- and web server processes spawning shells or recon tools
SELECT FullPath, Size, Mtime, Atime, Ctime
FROM glob(globs=[
'C:/inetpub/wwwroot/**/*.aspx',
'C:/inetpub/wwwroot/**/*.asp',
'C:/inetpub/wwwroot/**/*.ashx',
'C:/inetpub/wwwroot/**/*.php',
'C:/Program Files/**/webapps/**/*.jsp'
])
WHERE Mtime > now() - 1209600
ORDER BY Mtime DESC
-- Hunt for web server processes with shell or discovery children (live view)
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(whoami|nltest|net user|net group|ipconfig /all|certutil|vssadmin|powershell|cmd.exe)'
AND Name =~ '(?i)(cmd|powershell|pwsh|net|whoami|nltest|certutil|wmic)'
Hardening Script
For Windows environments running IIS (the most common webshell target in these campaigns), this PowerShell script audits for suspicious web content and enforces baseline hardening. Run elevated; review output before remediating:
# Compromise assessment: audit IIS content directories for recently created/modified script files
$WebRoots = @("C:\inetpub\wwwroot")
$IISConfig = Get-WebConfiguration -Filter "system.applicationHost/sites/site" -ErrorAction SilentlyContinue
foreach ($site in $IISConfig) {
$vdirs = Get-WebConfiguration -Filter "system.applicationHost/sites/site[@name='$($site.Name)']/application/virtualDirectory" -ErrorAction SilentlyContinue
foreach ($v in $vdirs) { if ($v.physicalPath) { $WebRoots += $v.physicalPath } }
}
$Since = (Get-Date).AddDays(-30)
$Suspicious = foreach ($root in ($WebRoots | Select-Object -Unique)) {
if (Test-Path $root) {
Get-ChildItem -Path $root -Recurse -Include *.aspx,*.asp,*.ashx,*.asmx,*.php -ErrorAction SilentlyContinue |
Where-Object { $_.LastWriteTime -gt $Since -or $_.CreationTime -gt $Since } |
Select-Object FullName, CreationTime, LastWriteTime, Length
}
}
$Suspicious | Sort-Object LastWriteTime -Descending | Format-Table -AutoSize
if ($Suspicious) { Write-Warning "Review the files above against your deployment records. Any file not traceable to a change ticket is a webshell suspect." }
# Verify IIS request filtering blocks high-risk extensions and double-escaping
Set-WebConfigurationProperty -PSPath 'MACHINE/WEBROOT/APPHOST' -Filter 'system.webServer/security/requestFiltering' -Name 'allowDoubleEscaping' -Value 'false'
# Audit: processes spawned by w3wp in the last 7 days (requires process creation auditing, Event ID 4688)
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688; StartTime=(Get-Date).AddDays(-7)} -ErrorAction SilentlyContinue |
Where-Object { $_.Message -match 'w3wp.exe' -and $_.Message -match '(cmd.exe|powershell.exe|net.exe|whoami.exe|certutil.exe)' } |
Select-Object TimeCreated, Message | Format-List
# Confirm attack surface reduction: block Office/script abuse is less relevant here; ensure Credential Guard on servers
$cg = Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard -ErrorAction SilentlyContinue
if ($cg.SecurityServicesRunning -notcontains 1) { Write-Warning "Credential Guard is NOT running on this host — enable via GPO to protect LSASS from dumping." }
For Linux perimeter and application servers:
# Find recently modified web content files (last 30 days) in common doc roots
find /var/www /usr/share/nginx /opt/tomcat/webapps -type f \( -name '*.php' -o -name '*.jsp' -o -name '*.jspx' -o -name '*.war' \) -mtime -30 -ls 2>/dev/null | sort -k11
# Identify web server processes with shell children right now
for pid in $(pgrep -f 'nginx|apache2|httpd|java'); do
children=$(pgrep -P "$pid" -a 2>/dev/null | grep -E 'bash|sh |curl|wget|nc |ncat|python|perl')
[ -n "$children" ] && echo "PARENT $pid: $children"
done
# Audit successful SSH/VPN logins from IPs that also appear in deny logs (targeted -> compromise pivot)
grep -h 'Failed\|Invalid' /var/log/auth.log* 2>/dev/null | grep -oE '([0-9]{1,3}\.){3}[0-9]{1,3}' | sort -u > /tmp/deny_ips.txt
grep -h 'Accepted' /var/log/auth.log* 2>/dev/null | grep -oE 'from ([0-9]{1,3}\.){3}[0-9]{1,3}' | awk '{print $2}' | sort -u > /tmp/accept_ips.txt
echo '--- IPs with BOTH failed and successful auth (investigate immediately) ---'
comm -12 /tmp/deny_ips.txt /tmp/accept_ips.txt
# Verify no unexpected listeners on edge/app hosts
ss -tulnp | awk 'NR>1 {print $5, $7}' | sort -u
Remediation
Because no specific CVE was disclosed in this reporting, remediation centers on validating your posture against the tradecraft these actors actually use:
- Run a compromise assessment, not a log review. If your organization appears in any threat actor target list or observes blocked exploit attempts against edge devices, scope for successful access: webshell artifacts, anomalous service accounts, unexpected scheduled tasks, and authentication from infrastructure known to be actor-controlled. The DoJ's correction is the right model — assume targeting is constant; prove or disprove compromise with evidence.
- Patch edge devices out-of-cycle. VPN concentrators, firewalls, load balancers, and email gateways from Fortinet, Ivanti, Palo Alto, Cisco, Citrix, F5, and SonicWall are the preferred initial-access surface for China-nexus actors. Subscribe to each vendor's PSIRT feed, monitor the CISA Known Exploited Vulnerabilities catalog for edge-device entries, and treat KEV additions on perimeter products as emergency-change items — CISA's remediation deadlines for federal agencies (typically 1–3 weeks for KEV entries) are a sensible private-sector benchmark.
- Instrument the perimeter you can't EDR. Forward firewall, VPN, WAF, and load balancer logs to your SIEM. If your only visibility into an edge device is its own local logs, an actor who owns it owns your evidence. Correlate blocked exploit signatures against subsequent successful authentications from the same sources.
- Enforce phishing-resistant MFA and rotate credentials after any confirmed perimeter event. Valid-account abuse is the most common post-exploitation path in these campaigns. FIDO2/passkeys for administrators; conditional access for everything else.
- Segment and constrain egress. Web and application servers should have no business initiating outbound connections to the internet except to approved update/CDN endpoints. Egress filtering is the single most reliable way to convert a quiet intrusion into a loud detection.
- Establish clear incident classification language now. Define "targeted," "attempted intrusion," and "confirmed compromise" in your IR plan and executive reporting templates. The DoJ needed a public correction to walk back a mislabeling; you don't want to make the same mistake in a board deck or a regulatory notification.
The takeaway from this correction isn't that the threat was overstated — it's that the targeting is real, ongoing, and directed at the highest-value networks in the country. Your job is to make sure that if an attempt against your organization ever succeeds, you're the one who finds it first.
Related Resources
Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.