Friday , July 12 2024
APT

8 cyber agencies warn APT40’s Rapid Exploit Adaptation

Cybersecurity agencies from Australia, Canada, Germany, Japan, New Zealand, South Korea, the UK, and the US issued a warning about a cyber espionage group called APT40, which is linked to China. The advisory cautions about the group’s capability to quickly and effectively use security flaws that are recently disclosed.

“APT 40 has previously targeted organizations in various countries, including Australia and the United States,” the agencies said. “Notably, APT 40 possesses the ability to quickly transform and adapt vulnerability proofs-of-concept (PoCs) for targeting, reconnaissance, and exploitation operations.”

CVE-2024-5910
Critical Vulnerability Threatens Palo Alto Networks’ Expedition

Palo Alto Networks has issued a critical security advisory outlining numerous vulnerabilities across its product lines, such as PAN-OS, Cortex...
Read More
CVE-2024-5910  Critical Vulnerability Threatens Palo Alto Networks’ Expedition

Vulnerabilities in GitLab Allows Attackers to Execute Unauthorized Pipelines

GitLab has issued a warning about a serious vulnerability in its GitLab Community and Enterprise editions. This vulnerability allows attackers...
Read More
Vulnerabilities in GitLab Allows Attackers to Execute Unauthorized Pipelines

Adobe Issues Critical Security Patches for Various Products

Adobe released security updates to fix several vulnerabilities in their software. These vulnerabilities could be used by cyber attackers to...
Read More
Adobe Issues Critical Security Patches for Various Products

CISA Warns Hacker Use OS Command Injection Vulnerabilities to Compromise Systems

OS command injection vulnerabilities are a preventable type of weakness in software. Manufacturers can eliminate them by taking a secure...
Read More
CISA Warns Hacker Use OS Command Injection Vulnerabilities to Compromise Systems

Pakistan allows spy agency to intercept phone messages, calls

The Pakistan Ministry of Information Technology and Telecommunication has given permission to the Inter-Services Intelligence (ISI) to intercept citizens’ phone...
Read More
Pakistan allows spy agency to intercept phone messages, calls

Citrix Issues Critical Security Advisory for NetScaler

Citrix has warned users about severe vulnerabilities in their widely-used NetScaler products. These vulnerabilities, known as CVE-2024-6235 and CVE-2024-6236, could...
Read More
Citrix Issues Critical Security Advisory for NetScaler

(CVE-2024-38080, CVE-2024-38112)
Microsoft July Patch Tuesday fixes 142 flaws, 4 zero-days

Microsoft's July 2024 Patch Tuesday includes security updates for 142 flaws, including two zero-days that are actively exploited and two...
Read More
(CVE-2024-38080, CVE-2024-38112)  Microsoft July Patch Tuesday fixes 142 flaws, 4 zero-days

EXCLUSIVE
Analysis of 3 Ransomware Threats Active Right Now

Three emerging threats will be discussed below, along with how sandbox analysis can be utilized to detect them proactively. Lockbit...
Read More
EXCLUSIVE  Analysis of 3 Ransomware Threats Active Right Now

AVAST RELEASED DECRYPTOR FOR DONEX RANSOMWARE

Avast researchers found a security flaw in the DoNex ransomware and its previous versions, which allowed them to create a...
Read More
AVAST RELEASED DECRYPTOR FOR DONEX RANSOMWARE

Critical Security Advisory for Apache CloudStack

The Apache Software Foundation has warned about two serious security issues (CVE-2024-38346 and CVE-2024-39864) in Apache CloudStack, a popular open-source...
Read More
Critical Security Advisory for Apache CloudStack

The adversarial group known by different names has been active since at least 2013, carrying out cyber attacks in the Asia-Pacific region. It is believed to be based in Haikou.

In July 2021, the U.S. and its allies blamed a group linked to China’s Ministry of State Security for organizing a long-term hacking campaign to steal trade secrets and high-value information from various sectors. Several members of the group were indicted.

APT40 has been associated with intrusion campaigns using the ScanBox reconnaissance framework and exploiting a security vulnerability in WinRAR (CVE-2023-38831, CVSS score: 7.8). They used these techniques in a phishing campaign targeting Papua New Guinea, delivering a backdoor called BOXRAT.

In March, the New Zealand government said that a threat actor was involved in the compromise of the Parliamentary Counsel Office and the Parliamentary Service in 2021.

“APT40 identifies new exploits within widely used public software such as Log4j, Atlassian Confluence, and Microsoft Exchange to target the infrastructure of the associated vulnerability,” the authoring agencies said.

China-linked APT40:

“APT40 regularly conducts reconnaissance against networks of interest, including networks in the authoring agencies’ countries, looking for opportunities to compromise its targets. This regular reconnaissance postures the group to identify vulnerable, end-of-life or no longer maintained devices on networks of interest, and to rapidly deploy exploits.”

A notable technique used by the state-sponsored hacking group is the use of web shells to keep access to the victim’s system. They also use Australian websites to control their operations.

Out-of-date or unpatched devices, like SOHO routers, are being used to reroute malicious traffic and avoid detection in cyber attacks. This operational style is similar to that used by other China-based groups like Volt Typhoon.

An attack chain involves reconnaissance, privilege escalation, and lateral movement using the remote desktop protocol (RDP) to steal credentials and exfiltrate valuable information.

To reduce these risks, consider implementing effective logging mechanisms, enforcing multi-factor authentication (MFA), maintaining a strong patch management system, replacing outdated equipment, disabling unused services, ports, and protocols, and segmenting networks to restrict access to sensitive data.

Check Also

cyble

Threat Actors Exploit Microsoft SmartScreen Vulnerability: Cyble

Cyble Analyzes An Active Campaign Exploiting A Microsoft SmartScreen Vulnerability To Deliver Stealers Via Spam …

Leave a Reply

Your email address will not be published. Required fields are marked *