FlagThis

A sophisticated cyber espionage campaign, dubbed ‘Operation Digital Eye,’ targeted business-to-business IT service providers in Southern Europe. Attackers leveraged Visual Studio Code Tunnels and Azure infrastructure for command and control, exploiting the tunnels for stealthy remote access. The campaign lasted approximately three weeks, from late June to mid-July 2024.

ImgSrc: blogger.googleusercontent.com

References:

• GBHackers Security - Visual Studio Tunnels Abused For Stealthy Remote Access - 15d
• @BleepingComputer - Chinese hackers targeting large IT service providers in Southern Europe were seen abusing Visual Studio Code (VSCode) tunnels to maintain persistent access to compromised systems. - 15d
• The Hacker News - Hackers Weaponize Visual Studio Code Remote Tunnels for Cyber Espionage - 15d
• SentinelLabs - SentinelOne reports on Operation Digital Eye, detailing the sophisticated techniques used by Chinese APT actors. - 15d
• Security Affairs - Operation Digital Eye: China-linked relies on Visual Studio Code Remote Tunnels to spy on Europen entities - 15d
• @VirusBulletin - Aleksandar Milenkoski (SentinelLabs) & Luigi Martire (Tinexta Cyber) look into ‘Operation Digital Eye’, an activity cluster from a suspected China-nexus threat actor targeting large business-to-bu - 15d
• Security Risk Advisors - SentinelOne report on Operation Digital Eye Chinese APT - 14d
• Over Security - Chinese hackers use Visual Studio Code tunnels for remote access. - 13d

Classification:

• HashTags: CyberEspionage Visual Studio Code Azure
• Company:
• Target: Business-to-business IT service providers
• Attacker: Chinese state-backed hackers
• Product: Visual Studio Code
• Feature: Visual Studio Code Tunnels
• Type: Espionage
• Severity: Major