Weaver Ant: The China-Nexus APT That Lived Inside a Telecom for Four Years

Executive Summary

Weaver Ant is a China-aligned threat actor specialising in long-duration, stealthy access to telecommunications infrastructure for the purpose of state-directed cyber espionage. The group was exposed by incident response firm Sygnia after a sustained engagement defending a major Asian telecommunications provider from an intrusion that lasted more than four years. Despite multiple remediation attempts by the defender, Weaver Ant maintained footholds and consistently re-established access, demonstrating the operational patience and resilience characteristic of China’s most capable intelligence-collection actors.

The group’s tradecraft centres on web shell persistence, in-memory execution to avoid forensic artefacts, and an operational relay box (ORB) network constructed from compromised telecommunications edge devices. The combination of low-footprint tooling, encrypted web shells, and geographically distributed proxy infrastructure makes Weaver Ant among the hardest persistent access threats to eradicate from enterprise networks.

Weaver Ant is assessed to be a nation-state actor whose primary mission is continuous access to telecommunications provider infrastructure, enabling the collection of network-level intelligence including subscriber metadata, call records, and routing data. The group does not appear to pursue financial gain or disruptive operations. Its victims and targeting patterns align with Chinese state intelligence priorities in the Asia-Pacific region.

Threat Actor Profile

Discovery and Attribution

Weaver Ant was named and detailed by Sygnia during a protracted incident response engagement at an unnamed Asian telecommunications company. The attacker had been present in the network for over four years at the time of discovery, and during the active response phase, survived multiple eradication attempts before Sygnia was finally able to fully eliminate the presence.

Attribution to a China-nexus actor rests on multiple technical and behavioural indicators. The tooling deployed — particularly the China Chopper web shell family — has a documented history of use by Chinese threat actors going back to the earliest publicly recorded deployments in 2012. The operational timezone pattern, consistent activity during GMT+8 business hours on weekdays with a sharp drop during Chinese national holidays and weekends, matches the operational tempo widely observed in Chinese state-sponsored intrusion sets. The use of an ORB network routed through Southeast Asian telecommunications infrastructure aligns with documented infrastructure procurement patterns seen across multiple China-nexus APT campaigns.

Sygnia has not formally mapped Weaver Ant to any existing vendor-designated intrusion set (UNC, TEMP, or numbered APT designations), treating it as a distinct cluster with possible overlaps to previously documented China-aligned telecom-targeting actors.

Initial Access

Weaver Ant’s initial access method in the documented campaign was not definitively established by Sygnia at the time of disclosure, a common outcome in intrusions where the threat actor has been present for multiple years and log retention predates the earliest indicators. However, the group’s subsequent use of compromised Zyxel CPE home routers as an initial pivot point into the victim’s network suggests that router vulnerability exploitation or credential compromise of edge devices may have provided the initial foothold.

Zyxel CPE devices operated by the victim telecommunications company — or by customers of that company — were compromised and incorporated into Weaver Ant’s ORB network. This provided the attacker with infrastructure that was physically and logically close to the target, originating traffic from IP addresses within the same operator’s address space, making network-level detection based on geography or ASN significantly harder.

The group subsequently exploited internet-facing web services on the victim’s internal infrastructure to deploy its web shell persistence layer. The specific services exploited have not been disclosed.

Persistence and Tooling

Weaver Ant’s primary persistence mechanism is web shell deployment on internal web servers. The group deployed two distinct web shell types, each serving a different operational function.

Encrypted China Chopper Variant

The foundational tool is an AES-encrypted variant of China Chopper, one of the most widely used web shells in Chinese threat actor operations since its first documented appearance in 2012. China Chopper is typically lightweight — under 4 kilobytes — consisting of a one-line server-side component and a standalone attacker-controlled client that connects to it.

Weaver Ant’s variant encrypts the communication channel between the attacker’s client and the web shell, rendering network-level traffic inspection and payload-based detection significantly less effective than against standard China Chopper deployments. The encrypted channel also obscures command and output content from defenders reviewing web server logs, since the observable artefact is encrypted binary rather than readable command strings.

INMemory Web Shell

Alongside the China Chopper variant, Weaver Ant deployed a novel web shell that Sygnia designated as INMemory. The INMemory web shell is designed to operate entirely within process memory, executing modules without writing to disk. This approach directly undermines forensic investigation by preventing analysis of dropped files and makes it substantially harder for endpoint detection products relying on file system scanning to identify the implant.

The INMemory web shell supports the dynamic loading and execution of modules passed to it in requests. An attacker can send arbitrary code to the in-memory web shell, which executes it and returns the output, without any persistent artefact being written to the host file system between sessions.

HTTP Recursive Tunnel

Weaver Ant implemented a recursive HTTP tunnelling mechanism to achieve lateral movement within the victim’s network without deploying additional tooling to each target host. The tunnel works by instructing a compromised web shell — already running on an internal server — to dynamically construct and relay HTTP requests on behalf of the attacker.

Effectively, the compromised server acts as a forward proxy. The attacker sends an HTTP request to the outer web shell, which encodes a second HTTP request inside it targeted at an internal host not directly reachable from the attacker’s infrastructure. The outer shell executes the inner request using cURL or an equivalent mechanism and relays the response back. By chaining multiple compromised servers, the attacker can traverse network segments without deploying any agent software to the intermediate hosts, leaving a minimal footprint on each hop in the chain.

ORB Network Infrastructure

A defining characteristic of Weaver Ant’s operational security is its use of an Operational Relay Box (ORB) network to proxy all traffic to and from the victim. ORB networks, documented extensively in context of multiple China-nexus APTs, use networks of compromised third-party devices to relay traffic, making attribution and blocking based on IP reputation or ASN substantially harder.

Weaver Ant’s ORB network was built from compromised Zyxel CPE (Customer Premises Equipment) home and small-office routers operated by Southeast Asian telecommunications providers. The use of telco-operated CPE devices is particularly significant for a campaign targeting another telco: traffic originating from addresses belonging to legitimate telecommunications operators is unlikely to be blocked by carrier-grade filters, and the geographic proximity reduces latency artefacts that might otherwise be visible in connection timing analysis.

The design also introduces a systemic risk for the broader telecommunications sector. Weaver Ant leveraged access to devices operated by one telecommunications company to establish a relay position from which it could target devices — and by extension, networks — belonging to other telecommunications operators in the region. A compromised CPE at Operator A becomes infrastructure for targeting Operator B.

Victim Targeting and Objectives

Weaver Ant targeted one of the most intelligence-rich organisations in any national economy: a major telecommunications provider. Telecommunications companies operate the infrastructure over which a nation’s communications flow — subscriber records, call detail records (CDRs), network routing tables, and the ability to intercept or divert traffic all exist within a telco’s operational systems.

For a state intelligence agency, persistent access to a telecommunications provider’s internal infrastructure offers capabilities that are difficult or impossible to replicate through other means:

• Subscriber intelligence: associating mobile device identifiers, SIM cards, and subscriber accounts with individuals
• Call detail records: metadata about who called whom, when, from where, and for how long — a rich dataset for pattern-of-life analysis without requiring content interception
• Lawful intercept infrastructure abuse: telecommunications providers operate lawful intercept systems for government requests; compromising the internal systems that manage these can redirect or duplicate their output
• Network topology: understanding how a telco’s routing infrastructure is designed enables future operations targeting that infrastructure or the organisations that depend on it

Weaver Ant’s observed behaviour within the network — focusing on sustained access and intelligence collection rather than data destruction, ransomware deployment, or visible disruption — is entirely consistent with a state-directed intelligence-collection mandate.

Historical Incidents and Campaign Context

Weaver Ant joins a well-established pattern of China-aligned threat actors targeting telecommunications infrastructure in the Asia-Pacific region and, more recently, globally. The group’s campaign overlaps temporally with the broader wave of Chinese APT activity against telcos documented by Five Eyes intelligence agencies and private sector researchers, including:

• Salt Typhoon: the most prominently reported China-nexus telco intrusion campaign, targeting US carriers including AT&T, Verizon, and T-Mobile in campaigns that accessed lawful intercept infrastructure and senior government communications metadata. Salt Typhoon is a separate threat cluster from Weaver Ant but shares the same strategic objective category.
• Volt Typhoon: a separate Chinese state actor focused on pre-positioning in US critical infrastructure, including telecommunications networks, for potential disruption operations in the event of conflict. Also distinct from Weaver Ant.

The existence of multiple distinct China-nexus actors simultaneously targeting telecommunications infrastructure globally suggests coordinated tasking across multiple Chinese intelligence and military organisations rather than a single campaign. Weaver Ant represents the Asia-Pacific strand of this broader pattern.

Defensive Implications

Web Shell Detection

Weaver Ant’s persistence relies entirely on web shells, making web shell detection the single highest-priority defensive control for telecommunications sector defenders. Effective detection requires:

• File integrity monitoring on web server directories: any new file in a document root or web application deployment directory should trigger review. Weaver Ant’s AES-encrypted China Chopper variant may evade signature-based detection; monitor for new files with unexpected extensions or file creation events from web server processes.
• Monitoring web server process children: web server processes (IIS, Apache, nginx, Tomcat) should not spawn command-line interpreters, PowerShell, or network tools. Process creation events from w3wp.exe, httpd, or equivalent with command-line descendants are high-confidence indicators.
• Memory forensics for in-memory web shells: the INMemory web shell does not write to disk, making file-based detection ineffective. Detection relies on monitoring anomalous network connections from web server processes, memory scanning for injected modules, and detecting cURL or HTTP requests originating from the web server process itself.

Network Segmentation and ORB Awareness

Telecommunications providers should audit the segmentation between customer-facing CPE management networks and internal operational systems. Weaver Ant’s use of CPE devices as ORB relay nodes means that traffic from within the operator’s own address space should not be trusted implicitly. Carrier-grade NAT infrastructure and CPE management networks should be treated as potential adversary access points and monitored accordingly.

Remediation Completeness

A critical finding from Sygnia’s engagement is that Weaver Ant survived multiple partial remediation attempts. When web shells are identified on a network, defenders must assume that the attacker has established multiple independent persistence mechanisms — different web shells, in-memory variants, and possibly additional access paths not yet discovered. Remediation should involve:

• Full enumeration of all web shells across all web servers before beginning any removal
• Assumption that attacker credentials have been harvested from any host where a web shell executed
• Forced rotation of all privileged credentials and service accounts
• Review of DNS, BGP routing configurations, and lawful intercept system access logs for signs of configuration changes during the intrusion period

Timezone-Based Detection

Weaver Ant’s consistent operation within GMT+8 business hours, with activity dropping sharply during weekends and Chinese public holidays, provides a supplementary behavioural detection opportunity. Organisations with normal operations in different time zones can create alerting rules for web shell activity or lateral movement during off-hours periods that align with GMT+8 working hours.

Assessment

Weaver Ant is assessed to be among the most operationally sophisticated China-nexus actors with documented public disclosure. Its use of AES-encrypted web shells, in-memory execution, HTTP recursive tunnelling, and a purpose-built ORB network from within the telecommunications sector represents a tradecraft investment that significantly exceeds the median observed intrusion set.

The four-year dwell time within a single victim’s network — and the ability to survive multiple remediation attempts — speaks both to the technical quality of the group’s persistence mechanisms and to the challenge of eradicating a determined state-sponsored actor from complex enterprise networks. Telecommunications sector security teams should treat Weaver Ant as a current, active threat regardless of geographic location: state intelligence priorities in the communications sector are global, and the group’s ORB infrastructure demonstrates both the reach and the patience to support multinational targeting.