China has denied involvement in the Volt Typhoon cyber espionage campaign, which has been attributed to Chinese state-sponsored hackers by US intelligence agencies. Volt Typhoon is believed to be targeting critical infrastructure in the Asia-Pacific region. The Chinese government maintains that there is insufficient evidence linking the campaign to China. However, US intelligence officials have presented evidence suggesting that the operation originated from China. This denials highlight the ongoing tensions between China and the US over cyber espionage and the difficulty in attributing cyberattacks with certainty.
A critical vulnerability in Ivanti’s Cloud Service Appliance (CSA) has been actively exploited by attackers. The flaw, tracked as CVE-2024-8190, allows attackers to gain unauthorized access to sensitive data and execute arbitrary commands on vulnerable systems. The vulnerability exists in the CSA’s authentication mechanism and can be exploited by attackers who can send specially crafted requests to the CSA. This attack vector allows attackers to bypass the CSA’s security measures and gain access to the underlying operating system. The vulnerability has been exploited in the wild by a suspected nation-state adversary. There are strong indications that China is behind the attacks. Organizations using Ivanti CSA should prioritize patching the vulnerability immediately to reduce their risk of being compromised.