InfoSecBulletin Cybersecurity for mankind
Cybersecurity agencies from Australia, Canada, Germany, Japan, New Zealand, South Korea, the UK, and the US issued a warning about a cyber espionage group called APT40, which is linked to China. The advisory cautions about the group’s capability to quickly and effectively use security flaws that are recently disclosed.
“APT 40 has previously targeted organizations in various countries, including Australia and the United States,” the agencies said. “Notably, APT 40 possesses the ability to quickly transform and adapt vulnerability proofs-of-concept (PoCs) for targeting, reconnaissance, and exploitation operations.”
WhatsApp banned on all US House of Representatives devices
Kaspersky found “SparkKitty” Malware on Google Play, Apple App Store
OWASP AI Testing Guide Launched to Uncover Vulns in AI Systems
Axentec Launches Bangladesh’s First Locally Hosted Tier-4 Cloud Platform
Hackers Bypass Gmail MFA With App-Specific Password Reuse
Russia detects first SuperCard malware attacks via NFC
Income Property Investments exposes 170,000+ Individuals record
ALERT (CVE: 2023-28771)
Zyxel Firewalls Under Attack via CVE-2023-28771 by 244 IPs
CISA Flags Active Exploits in Apple iOS and TP-Link Routers
10K Records Allegedly from Mac Cloud Provider’s Customers Leaked Online
The adversarial group known by different names has been active since at least 2013, carrying out cyber attacks in the Asia-Pacific region. It is believed to be based in Haikou.
In July 2021, the U.S. and its allies blamed a group linked to China’s Ministry of State Security for organizing a long-term hacking campaign to steal trade secrets and high-value information from various sectors. Several members of the group were indicted.
APT40 has been associated with intrusion campaigns using the ScanBox reconnaissance framework and exploiting a security vulnerability in WinRAR (CVE-2023-38831, CVSS score: 7.8). They used these techniques in a phishing campaign targeting Papua New Guinea, delivering a backdoor called BOXRAT.
In March, the New Zealand government said that a threat actor was involved in the compromise of the Parliamentary Counsel Office and the Parliamentary Service in 2021.
“APT40 identifies new exploits within widely used public software such as Log4j, Atlassian Confluence, and Microsoft Exchange to target the infrastructure of the associated vulnerability,” the authoring agencies said.
China-linked APT40:
“APT40 regularly conducts reconnaissance against networks of interest, including networks in the authoring agencies’ countries, looking for opportunities to compromise its targets. This regular reconnaissance postures the group to identify vulnerable, end-of-life or no longer maintained devices on networks of interest, and to rapidly deploy exploits.”
A notable technique used by the state-sponsored hacking group is the use of web shells to keep access to the victim’s system. They also use Australian websites to control their operations.
Out-of-date or unpatched devices, like SOHO routers, are being used to reroute malicious traffic and avoid detection in cyber attacks. This operational style is similar to that used by other China-based groups like Volt Typhoon.
An attack chain involves reconnaissance, privilege escalation, and lateral movement using the remote desktop protocol (RDP) to steal credentials and exfiltrate valuable information.
To reduce these risks, consider implementing effective logging mechanisms, enforcing multi-factor authentication (MFA), maintaining a strong patch management system, replacing outdated equipment, disabling unused services, ports, and protocols, and segmenting networks to restrict access to sensitive data.
