Saturday , February 15 2025
telco

China-linked spies target Asian Telcos since 2021

A group believed to be linked to China has hacked multiple telecom operators in an Asian country since 2021, according to the Symantec Threat Hunter Team.

The attackers used tools linked to Chinese spying groups. They installed several backdoors on targeted companies’ networks to steal passwords.

Xploit_Cr3w and Blind_Virus, champion for BCS CTF contest

Xploit_Cr3w and Blind_Virus are the two champion teams categorically for BCS ICT Fest 2025 arranged jointly by BCS and BUET....
Read More
Xploit_Cr3w and Blind_Virus, champion for BCS CTF contest

Salt Typhoon Exploits Vulnerable Cisco Devices of Telcoms Globally

Between December 2024 and January 2025, Recorded Future's Insikt Group discovered a campaign targeting unpatched Cisco devices used by major...
Read More
Salt Typhoon Exploits Vulnerable Cisco Devices of Telcoms Globally

CISA Releases Advisories For 20 Industrial Control Systems (ICS)

On February 13, 2025, the Cybersecurity and Infrastructure Security Agency (CISA) issued 20 advisories about serious vulnerabilities in Industrial Control...
Read More
CISA Releases Advisories For 20 Industrial Control Systems (ICS)

“Astaroth” Phishing Kit Bypasses 2FA Of Gmail, Yahoo, AOL, M365

The new Astaroth Phishing Kit can bypass two-factor authentication to steal login credentials for Gmail, Yahoo, and Microsoft. It uses...
Read More
“Astaroth” Phishing Kit Bypasses 2FA Of Gmail, Yahoo, AOL, M365

CVE-2023-38831
Malware campaign target Bangladeshi Government Entities: Report

A sophisticated malware campaign is targeting military and government entities in Bangladesh. It uses social engineering to deliver malicious files...
Read More
CVE-2023-38831  Malware campaign target Bangladeshi Government Entities: Report

(CVE-2025-1146
CrowdStrike Fixed High-Severity TLS Vuln in Falcon Sensor

CrowdStrike has issued a security advisory for a serious TLS vulnerability, CVE-2025-1146, in its Falcon Sensor for Linux, Falcon Kubernetes...
Read More
(CVE-2025-1146  CrowdStrike Fixed High-Severity TLS Vuln in Falcon Sensor

CVE-2025-0108 & CVE-2025-0110
Palo Alto Networks Addressed High-Severity PAN-OS Vulns

Palo Alto Networks has issued advisories for two critical vulnerabilities in its PAN-OS. The vulnerabilities, CVE-2025-0108 and CVE-2025-0110, may enable...
Read More
CVE-2025-0108 & CVE-2025-0110  Palo Alto Networks Addressed High-Severity PAN-OS Vulns

Update Now
Ivanti Patches 3 Critical Flaws in Connect Secure and Policy Secure

Ivanti has released security updates for Ivanti Connect Secure (ICS), Ivanti Policy Secure (IPS), and Ivanti Secure Access Client (ISAC)...
Read More
Update Now  Ivanti Patches 3 Critical Flaws in Connect Secure and Policy Secure

This Adtech Company is Powering Surveillance of U.S. Military Personnel

Last year, a joint investigation revealed that a Florida-based data broker, Datastream Group, was selling highly sensitive location data that...
Read More
This Adtech Company is Powering Surveillance of U.S. Military Personnel

Intel Patched 374 Vulnerabilities in multiple products

In 2024, Intel addressed a remarkable 374 vulnerabilities across its software, firmware, and hardware products, distributing bug bounty rewards for...
Read More
Intel Patched 374 Vulnerabilities in multiple products

“The attacks have been underway since at least 2021, with evidence to suggest that some of this activity may even date as far back as 2020. Virtually all of the organizations targeted were telecoms operators, with the addition of a services company that serves the telecoms sector and a university in another Asian country.” reads the report published by Broadcom Symantec Threat Hunter Team.

The experts have found evidence indicating that the cluster activity may have started in 2020.

In a recent espionage operation, the attackers used custom malware linked to various Chinese APT groups. Some of the malware used by the attackers are:

Coolclient: A backdoor associated with the Fireant group (also known as Mustang Panda or Earth Preta) hasA backdoor was found to be associated with the Fireant group, also known as Mustang Panda or Earth Preta. It records keystrokes, handles files, and communicates with a C2 server. This campaign utilized a disguised version of VLC Media Player (named googleupdate.exe) to load a Coolclient loader. The loader is responsible for decrypting and executing the payloads.

Quickheal: There is a backdoor linked to the Needleminer group. It is also known as RedFoxtrot or Nomad Panda. The attackers used a 32-bit DLL variant in recent attacks. It communicates with a fixed C&C server using a custom protocol that imitates SSL traffic.

Rainyday: A recent espionage campaign used a backdoor connected to the Firefly group, also known as Naikon.

Other TTPs
Aside from the aforementioned custom backdoors, the attackers employed a diverse range of tactics, techniques, and procedures (TTPs):
Keylogging malware, possibly custom-developed
Port scanning: At least three distinct port-scanning tools were deployed
Credential theft through the dumping of registry hives
Responder: A publicly available tool that acts as a Link-Local Multicast Name Resolution (LLMNR) NetBIOS Name Service (NBT-NS) and multicast DNS (mDNS) poisoner
Enabling RDP

The cyber espionage group used custom backdoors and a variety of tactics and tools to attack their targets. They used keylogging malware, port scanning tools, credential theft, a tool called Responder, and enabled RDP.

“Tools used in this campaign have strong associations with multiple Chinese groups and at least three of the custom backdoors deployed are believed to be used exclusively by Chinese espionage actors.” concludes the report.” “The nature of the link between the actors involved in the current campaign remains unclear. Possibilities include, but are not limited to:

Attacks by multiple separate actors.
One actor using tools and/or personnel obtained or shared from other groups.
Multiple actors collaborating in a single campaign.

The ultimate motive of the intrusion campaign remains unclear.”

(Media Disclaimer: This report is based on research conducted internally and externally using different ways. The information provided is for reference only, and users are responsible for relying on it. Infosecbulletin is not liable for the accuracy or consequences of using this information by any means)

Check Also

security vendors

Account Credentials for Security Vendors Found on Dark Web: Cyble Report

# “While many leaked security credentials belong to customers, some exposed sensitive accounts suggest that …

Leave a Reply

Your email address will not be published. Required fields are marked *