A China-linked threat group has been compromising websites to plant the ScanBox JavaScript reconnaissance framework on visitors’ browsers, targeting organizations in Australia and energy firms in the South China Sea region.
The campaign, believed to be the work of APT TA423 (also known as Red Ladon), ran from April through mid-June 2022 according to a joint report by Proofpoint and PwC. The group has a long track record — a 2021 Department of Justice indictment tied it to the Hainan Province Ministry of State Security and charged four Chinese nationals with global computer intrusions spanning a dozen countries.
What makes ScanBox particularly nasty is that it doesn’t need malware on disk. The JavaScript-based framework runs in the browser, capturing keystrokes and performing browser fingerprinting — collecting OS details, installed plugins, and WebRTC data. It even uses STUN servers to punch through NAT, letting attackers reach machines behind firewalls.
The attack chain started with phishing emails with subject lines like “Sick Leave” and “Request Cooperation,” sent from what appeared to be the “Australian Morning News,” a fictional organization. The links led to cloned news pages that silently delivered the ScanBox payload.
TA423 has targeted victims across aviation, defense, education, government, healthcare, biopharmaceutical, and maritime industries in countries including the US, UK, Germany, Canada, Indonesia, Malaysia, and Saudi Arabia. Despite the 2021 indictment, researchers say the group hasn’t slowed down.
Organizations should monitor for suspicious JavaScript injections on web properties and watch for anomalous browser behavior that could indicate reconnaissance activity.
