China's Salt Typhoon Cyberspies Continue Their Years-long Hacking Campaign

 

Be highly alert of the China-based APT threat actors, like Salt Typhoon (and of the others too).

If you use the following products then DO patch them immediately:

Ivanti Connect Secure and Ivanti Policy Secure: CVE-2024-21887 & CVE-2023-46805.

Palo Alto Networks PAN-OS GlobalProtect: CVE-2024-3400

Cisco Internetworking Operating System (IOS) XE: CVE-2023-20273 & CVE-2023-20198

Cisco IOS and IOS XE: CVE-2023-20198 & CVE-2018-0171

https://bit.ly/4n3jIZA

"...Brett Leatherman (FBI Assistant Director) told media outlets that Salt Typhoon targeted more than 600 organizations across 80 countries."

"The international coalition also called out three China-based entities affiliated with Salt Typhoon – Sichuan Juxinhe Network Technology, Beijing Huanyu Tianqiong Information Technology, and Sichuan Zhixin Ruijie Network Technology – that it accused of providing cyber products and services to China's Ministry of State Security and People's Liberation Army."

"In addition to the four US agencies (FBI, CISA, National Security Agency, and Department of Defense Cyber Crime Center), the UK's National Cyber Security Centre plus government agencies in Australia, Canada, New Zealand, the Czech Republic, Finland, Germany, Italy, Japan, the Netherlands, Poland, and Spain also co-issued the security alert."

"'In addition to targeting telecommunications, reported targeting of hospitality and transportation by this actor could be used to closely surveil individuals,' he said. 'Information from these sectors can be used to develop a full picture of who someone is talking to, where they are, and where they are going.'"

SideWinder APT Targets Critical Infrastructures

An advanced persistent threat (APT) group known as SideWinder (allegedly Indian origin) is targeting critical infrastructure sectors within Asia, the Middle East, and Africa, with a focus on maritime, nuclear, and logistics operations.

SideWinder is demonstrating increased sophistication in its cyberattacks, enhancing its tools and techniques to evade security software and maintain persistent access to compromised networks. The group utilizes spear-phishing campaigns, delivering malicious documents that exploit the CVE-2017-11882 Microsoft Office vulnerability to deploy the StealerBot malware, a modular toolkit designed for stealing sensitive information.

Headlines:

"The attacks, observed by Kaspersky in 2024, spread across Bangladesh, Cambodia, Djibouti, Egypt, the United Arab Emirates, and Vietnam. Other targets of interest include nuclear power plants and nuclear energy infrastructure in South Asia and Africa, as well as telecommunication, consulting, IT service companies, real estate agencies, and hotels.

"'They are constantly monitoring detections of their toolset by security solutions,' Kaspersky said. 'Once their tools are identified, they respond by generating a new and modified version of the malware, often in under five hours.'"

Kyivstar Hack

 Why are the critical infrastructures are important?

Having a blackout of internet services occurs not only in the movies if necessary countermeasures are not taken.

Russia -allegedly- has been using the critical infrastructures of Ukraine as a Guinea pig for more than 10 years. (Yes, even before the Russian invasion.) This time, Russia -allegedly- committed another cyber attack to the biggest mobile telecom operator of Ukraine. This attack caused more than half of Ukraine's population (appr. 22 million) to go offline including the emergency air-raid system in the capital region.

This was the most significant attack by Russia which hit Ukrainian communication infrastructures since February 2022.

Well, are the critical infrastructures of your country prepared for such cyber attacks? Have you ever thought what would you do in a crisis where you won't have any internet connection? Sounds scary, huh? A little exaggerated movie but I can advise the movie Die Hard 4.0 for that.

https://bit.ly/3RMpnXg

"Kyivstar, Ukraine's biggest mobile telecom operator, has suffered a cyberattack that took out cell service for more than half of Ukraine's population and cut Internet for millions — as well as knocking offline the emergency air-raid system in the capital region.

Company CEO Oleksandr Komarov, speaking on a Ukrainian news broadcast as reported by Reuters, confirmed the attack on Tuesday, adding that the telco's IT infrastructure is "partially destroyed," and that he has no timeline on restoration."