InfoSecBulletin Cybersecurity for mankind
The China-linked APT group Salt Typhoon is still attacking networks globally, focusing on telecommunications, government, transportation, hospitality, and military sectors.
“While these actors focus on large backbone routers of major telecommunications providers, as well as provider edge (PE) and customer edge (CE) routers, they also leverage compromised devices and trusted connections to pivot into other networks,” according to a joint cybersecurity advisory published Wednesday. “These actors often modify routers to maintain persistent, long-term access to networks.”
Researchers show new technique to bypass AI safety guardrails in Grok and Gemini
About thousands of leaked AWS keys Held Full Admin Rights
US Bank investigates LockBit’s Data Breach Claims
Five new malware families actively targeting Asian Gov.t infra
T-Mobile Cuts Cables to Remove Chiness Salt Typhoon Hackers from Network
Splunk, Zyxel Patch Multiple Flaws Enabling RCE and Root Command Execution
“Zombie Card” attack revels expired Visa card may be used for contactless payments
Critical Zimbra RCE Flaw Actively Exploited in the Wild
Operation CameraSwarm
A single hacker compromise 1400+ Dahua camera worldwide
Cl0p Ransomware Listed 40+ Victims of PTC Windchill Campaign
The advisory, shared by authorities from 13 countries, said this malicious behavior has been linked to three Chinese companies: Sichuan Juxinhe Network Technology Co., Ltd., Beijing Huanyu Tianqiong Information Technology Co., Ltd., and Sichuan Zhixin Ruijie Network Technology Co., Ltd.
The countries that have issued the security alert include Australia, Canada, the Czech Republic, Finland, Germany, Italy, Japan, the Netherlands, New Zealand, Poland, Spain, the U.K., and the U.S.
According to The Wall Street Journal and The Washington Post, the hacking crew has expanded its targeting focus to other sectors and regions, attacking no less than 600 organizations, including 200 in the U.S., and 80 countries.
Salt Typhoon, associated with GhostEmperor, Operator Panda, RedMike, and UNC5807, gained initial access by exploiting vulnerabilities in exposed Cisco (CVE-2018-0171, CVE-2023-20198, CVE-2023-20273), Ivanti (CVE-2023-46805, CVE-2024-21887), and Palo Alto Networks (CVE-2024-3400) devices.
“The APT actors collected PCAPs using native tooling on the compromised system, with the primary objective likely being to capture TACACS+ traffic over TCP port 49,” the agencies said. “TACACS+ traffic is used for authentication, often for administration of network equipment and including highly privileged network administrators’ accounts and credentials, likely enabling the actors to compromise additional accounts and perform lateral movement.”
Salt Typhoon has been seen activating the sshd_operns service on Cisco IOS XR devices to create a local user with elevated privileges.
Storm-0501 Deletes Data and Backups Post-Exfiltration on Azure in Hybrid Cloud Attacks
