InfoSecBulletin Cybersecurity for mankind
Cybersecurity agencies from Australia, Canada, Germany, Japan, New Zealand, South Korea, the UK, and the US issued a warning about a cyber espionage group called APT40, which is linked to China. The advisory cautions about the group’s capability to quickly and effectively use security flaws that are recently disclosed.
“APT 40 has previously targeted organizations in various countries, including Australia and the United States,” the agencies said. “Notably, APT 40 possesses the ability to quickly transform and adapt vulnerability proofs-of-concept (PoCs) for targeting, reconnaissance, and exploitation operations.”
First couple “Rosie” to conceive using AI tech “STAR” successfully
Scattered Spider Actively Attacking Aviation and Transportation: FBI
Russia’s restrictions on Cloudflare making websites inaccessible
61 million Verizon records allegedly posted online for sale
Cyber Expert ‘Rene Joshilda’ Arrested for Bomb Hoaxes
Critical RCE Flaws in Cisco ISE and ISE-PIC Allow to Gain Root Access
CISA Warns of FortiOS Hard-Coded Credentials Vulns
5 vendors’ printer totaling 748 models affected: Rapid7
Citrix Released Emergency Patches for Actively Exploited CVE-2025-6543
SonicWall warns of a trojanized NetExtender stealing VPN logins
The adversarial group known by different names has been active since at least 2013, carrying out cyber attacks in the Asia-Pacific region. It is believed to be based in Haikou.
In July 2021, the U.S. and its allies blamed a group linked to China’s Ministry of State Security for organizing a long-term hacking campaign to steal trade secrets and high-value information from various sectors. Several members of the group were indicted.
APT40 has been associated with intrusion campaigns using the ScanBox reconnaissance framework and exploiting a security vulnerability in WinRAR (CVE-2023-38831, CVSS score: 7.8). They used these techniques in a phishing campaign targeting Papua New Guinea, delivering a backdoor called BOXRAT.
In March, the New Zealand government said that a threat actor was involved in the compromise of the Parliamentary Counsel Office and the Parliamentary Service in 2021.
“APT40 identifies new exploits within widely used public software such as Log4j, Atlassian Confluence, and Microsoft Exchange to target the infrastructure of the associated vulnerability,” the authoring agencies said.
China-linked APT40:
“APT40 regularly conducts reconnaissance against networks of interest, including networks in the authoring agencies’ countries, looking for opportunities to compromise its targets. This regular reconnaissance postures the group to identify vulnerable, end-of-life or no longer maintained devices on networks of interest, and to rapidly deploy exploits.”
A notable technique used by the state-sponsored hacking group is the use of web shells to keep access to the victim’s system. They also use Australian websites to control their operations.
Out-of-date or unpatched devices, like SOHO routers, are being used to reroute malicious traffic and avoid detection in cyber attacks. This operational style is similar to that used by other China-based groups like Volt Typhoon.
An attack chain involves reconnaissance, privilege escalation, and lateral movement using the remote desktop protocol (RDP) to steal credentials and exfiltrate valuable information.
To reduce these risks, consider implementing effective logging mechanisms, enforcing multi-factor authentication (MFA), maintaining a strong patch management system, replacing outdated equipment, disabling unused services, ports, and protocols, and segmenting networks to restrict access to sensitive data.
