Israel Gubi
Israel Gubi is a Senior Security Researcher at Check Point Research, where he focuses on threat hunting and reverse engineering of advanced persistent threat (APT) groups. Israel’s research has been presented at leading security conferences including Virus Bulletin, BlueHat, and AVA
Session
Some of the most effective malicious traffic is the traffic no one thinks to question. In the Ink Dragon campaign, what appeared to be routine cross-border government connectivity was in fact the first visible layer of a hidden relay network.
In this talk, we present Ink Dragon, a China-nexus espionage cluster that has targeted government and telecommunications entities in Southeast Asia and is now expanding into Europe. Rather than deploying new infrastructure, the actor turned its victims into infrastructure - chaining compromised systems into a multi-hop relay network that routed commands and exfiltrated data across organizational and national boundaries while blending into trusted inter-government communication flows.
We detail how investigating a single compromised environment led us to uncover this relay network and map a campaign far larger than any individual victim could see. By pivoting from a compromised endpoint to the upstream relays feeding it and then tracing back downstream to other victims behind those same relays, we correlated activity across environments that appeared entirely unrelated, revealing dozens of previously unknown compromised systems while the operation was still active.
This investigation required fusing incident response, reverse engineering, and threat intelligence to connect what initially looked like isolated intrusions into a single coordinated operation. We provide technical deep dives into key components of the actor's arsenal, and show how analysis of these tools helped us link activity across victims and trace the relay network to its full extent. Ink Dragon is a case study in how modern espionage campaigns are designed to remain invisible at the single-organization level and what it takes to break that design.