APT TA423 Targets South China Sea Energy Interests with ScanBox “Watering Hole” Attacks

Security researchers from Proofpoint and PwC have identified a renewed cyber-espionage campaign by the China-based threat actor TA423 (also known as Red Ladon). The group is reportedly utilizing a sophisticated “watering hole” strategy to deploy ScanBox, a JavaScript-based reconnaissance tool, targeting Australian domestic organizations and offshore energy firms operating in the South China Sea.

Active between April and June 2022, the campaign leverages a fictional media outlet, the “Australian Morning News,” to lure high-value targets. By directing victims to a malicious domain that mirrors legitimate news content from the BBC and Sky News, TA423 is able to conduct extensive reconnaissance without ever planting traditional malware on the victim’s disk.

The Mechanism: “ScanBox” and Browser Fingerprinting

The core of this operation is the ScanBox framework, a decade-old tool favored by state-sponsored actors for its stealth. Unlike typical malware, ScanBox executes entirely within the user’s web browser.

• Keylogging: The script records all user input on the compromised page, capturing credentials or sensitive data typed into the fake site.

• Zero-Footprint: Because the JavaScript runs in-memory, it leaves no traditional traces on the computer’s hard drive, making it exceptionally difficult for legacy antivirus software to detect.

• NAT Traversal: In a sophisticated technical twist, ScanBox utilizes the STUN (Session Traversal Utilities for NAT) protocol. By leveraging WebRTC APIs, the tool can discover a victim’s real IP address and port numbers, even if they are behind a firewall or NAT gateway, establishing a direct communication line to the attackers’ command-and-control servers.

Geopolitical Context and Attribution

Proofpoint attributes this activity to TA423 with moderate confidence, linking the group to the Hainan Province Ministry of State Security (MSS). The group’s focus remains sharply aligned with China’s strategic interests in the South China Sea, including naval issues and regional tensions in Taiwan, Malaysia, and Singapore.

Despite a 2021 indictment by the U.S. Department of Justice, researchers note that TA423’s operational tempo has not slowed. The group continues to pursue trade secrets and confidential business information across global industries including aviation, defense, and maritime.

The Evolution of “Malware-less” Espionage

The TA423 campaign represents a masterclass in pre-exploitation reconnaissance. By deploying ScanBox via a watering hole, the attackers are not looking for an immediate “win”; rather, they are conducting browser fingerprinting to identify specific vulnerabilities in the target’s environment.

The use of WebRTC and STUN is particularly significant. It demonstrates that APTs are increasingly moving away from “noisy” executable files and toward exploiting standardized web protocols. This allows them to bypass traditional network defenses that assume browser traffic is inherently safe.

For organizations in the energy and maritime sectors, this shift means that Endpoint Detection and Response (EDR) systems must focus more heavily on monitoring browser behavior and unauthorized API calls (like WebRTC) rather than just scanning for malicious .exe files. In the current geopolitical climate, a simple visit to a “news website” can now provide a state-sponsored actor with the exact blueprint of a corporate network’s internal defenses.