InfoSecBulletin Cybersecurity for mankind
Cybersecurity agencies from Australia, Canada, Germany, Japan, New Zealand, South Korea, the UK, and the US issued a warning about a cyber espionage group called APT40, which is linked to China. The advisory cautions about the group’s capability to quickly and effectively use security flaws that are recently disclosed.
“APT 40 has previously targeted organizations in various countries, including Australia and the United States,” the agencies said. “Notably, APT 40 possesses the ability to quickly transform and adapt vulnerability proofs-of-concept (PoCs) for targeting, reconnaissance, and exploitation operations.”
“Forces Penpals” exposed US and UK Military Social Network’s 1 Million Records
CVE-2024-51503
Trend Micro released updates for Deep Security Agent RCE
Apple Releases Patch for two Actively Exploited Zero-Day
Maxar Space Data Leak, Company admit, Investigation ongoing!
GitHub CLI Vulnerability Could Allow RCE
“Sarcoma” ransomware group
Hacker to disclose “Popular Life Insurance” 36 GB of stolen data
BugHunt 2024: A Milestone Cyber security Competition held at Dhaka
TP-Link DHCP Vulnerability Allow Attackers Takeover Routers Remotely
WSJ reports
T-Mobile hacked in massive breach of telecom networks
Palo Alto Networks Confirms critical RCE zero-day actively exploited
The adversarial group known by different names has been active since at least 2013, carrying out cyber attacks in the Asia-Pacific region. It is believed to be based in Haikou.
In July 2021, the U.S. and its allies blamed a group linked to China’s Ministry of State Security for organizing a long-term hacking campaign to steal trade secrets and high-value information from various sectors. Several members of the group were indicted.
APT40 has been associated with intrusion campaigns using the ScanBox reconnaissance framework and exploiting a security vulnerability in WinRAR (CVE-2023-38831, CVSS score: 7.8). They used these techniques in a phishing campaign targeting Papua New Guinea, delivering a backdoor called BOXRAT.
In March, the New Zealand government said that a threat actor was involved in the compromise of the Parliamentary Counsel Office and the Parliamentary Service in 2021.
“APT40 identifies new exploits within widely used public software such as Log4j, Atlassian Confluence, and Microsoft Exchange to target the infrastructure of the associated vulnerability,” the authoring agencies said.
China-linked APT40:
“APT40 regularly conducts reconnaissance against networks of interest, including networks in the authoring agencies’ countries, looking for opportunities to compromise its targets. This regular reconnaissance postures the group to identify vulnerable, end-of-life or no longer maintained devices on networks of interest, and to rapidly deploy exploits.”
A notable technique used by the state-sponsored hacking group is the use of web shells to keep access to the victim’s system. They also use Australian websites to control their operations.
Out-of-date or unpatched devices, like SOHO routers, are being used to reroute malicious traffic and avoid detection in cyber attacks. This operational style is similar to that used by other China-based groups like Volt Typhoon.
An attack chain involves reconnaissance, privilege escalation, and lateral movement using the remote desktop protocol (RDP) to steal credentials and exfiltrate valuable information.
To reduce these risks, consider implementing effective logging mechanisms, enforcing multi-factor authentication (MFA), maintaining a strong patch management system, replacing outdated equipment, disabling unused services, ports, and protocols, and segmenting networks to restrict access to sensitive data.
