InfoSecBulletin Cybersecurity for mankind
A group believed to be linked to China has hacked multiple telecom operators in an Asian country since 2021, according to the Symantec Threat Hunter Team.
The attackers used tools linked to Chinese spying groups. They installed several backdoors on targeted companies’ networks to steal passwords.
Critical cPanel, GitLab AI Gateway and Dell CSM Flaws Enable RCE And Admin Hijacking
Nearly 100,000 email addresses exposed in first AI-related data breach in Singapore
Hackers Exploit Zimbra Mail Servers: TeamViewer patched 5 critical flaws
Google Warns of Hackers Actively Exploiting Citrix 0-Day Flaws
CISA Warns Critical MikroTik RouterOS Flaw While Cisco SD-WAN Zero-Day Exploited in Attacks
Apple Zero-Day Exploited: Pentagon Data Breach Reportedly Exposes Sensitive Data of 3 Million People
JadePuffer Agentic AI targets and destroys Azure’s cloud resources
“InfoSecCon-2026: Bangladesh’s Cybersecurity Leaders Unite to Shape a Safer Digital Future”
Microsoft Patches CVSS 10.0 Azure AI Foundry Vulnerability Allowing Privilege Escalation
AWS is unable to restore access to Bahrain, one UAE cloud data zone after war damage
“The attacks have been underway since at least 2021, with evidence to suggest that some of this activity may even date as far back as 2020. Virtually all of the organizations targeted were telecoms operators, with the addition of a services company that serves the telecoms sector and a university in another Asian country.” reads the report published by Broadcom Symantec Threat Hunter Team.
The experts have found evidence indicating that the cluster activity may have started in 2020.
In a recent espionage operation, the attackers used custom malware linked to various Chinese APT groups. Some of the malware used by the attackers are:
Coolclient: A backdoor associated with the Fireant group (also known as Mustang Panda or Earth Preta) hasA backdoor was found to be associated with the Fireant group, also known as Mustang Panda or Earth Preta. It records keystrokes, handles files, and communicates with a C2 server. This campaign utilized a disguised version of VLC Media Player (named googleupdate.exe) to load a Coolclient loader. The loader is responsible for decrypting and executing the payloads.
Quickheal: There is a backdoor linked to the Needleminer group. It is also known as RedFoxtrot or Nomad Panda. The attackers used a 32-bit DLL variant in recent attacks. It communicates with a fixed C&C server using a custom protocol that imitates SSL traffic.
Rainyday: A recent espionage campaign used a backdoor connected to the Firefly group, also known as Naikon.
The cyber espionage group used custom backdoors and a variety of tactics and tools to attack their targets. They used keylogging malware, port scanning tools, credential theft, a tool called Responder, and enabled RDP.
“Tools used in this campaign have strong associations with multiple Chinese groups and at least three of the custom backdoors deployed are believed to be used exclusively by Chinese espionage actors.” concludes the report.” “The nature of the link between the actors involved in the current campaign remains unclear. Possibilities include, but are not limited to:
Attacks by multiple separate actors.
One actor using tools and/or personnel obtained or shared from other groups.
Multiple actors collaborating in a single campaign.
The ultimate motive of the intrusion campaign remains unclear.”
(Media Disclaimer: This report is based on research conducted internally and externally using different ways. The information provided is for reference only, and users are responsible for relying on it. Infosecbulletin is not liable for the accuracy or consequences of using this information by any means)
