FlagThis

The US Treasury Department sanctioned a Chinese cybersecurity firm, Sichuan Juxinhe, and a Shanghai-based hacker, Yin Kecheng, for their involvement in the Salt Typhoon cyberattacks. These attacks targeted major US telecom companies, compromising sensitive data and the US Treasury’s network, including systems used for sanctions and foreign investment reviews, and even impacted the computer of the outgoing Treasury Secretary Janet Yellen. This highlights the ongoing sophisticated cyber espionage campaigns from China targeting critical infrastructure and government entities within the US and globally. The sanctioned entities are directly linked to the Chinese Ministry of State Security (MSS), and used a combination of zero-day exploits and other techniques for infiltrating networks and exfiltrating data. The compromise of the Department of the Treasury’s network is considered a major breach, potentially impacting national security due to access to sensitive information.

The US Department of Justice, with the FBI, conducted a multi-month operation to remove the PlugX malware from over 4,200 infected computers in the United States. PlugX is a remote access trojan (RAT) widely used by threat actors associated with the People’s Republic of China. This action targeted the command and control infrastructure used by these actors to compromise systems, disrupting their ability to maintain persistent access and conduct further malicious activities on affected networks. The operation underscores the US government’s proactive efforts in combating state-sponsored cyber espionage activities, aiming to neutralize threats before they can be further leveraged for malicious purposes.

The Chinese state-sponsored group, RedDelta, has been actively targeting Mongolia, Taiwan, and Southeast Asia since July 2023. The group uses evolving cyber threats to distribute its customized PlugX backdoor. RedDelta employs spearphishing techniques with lure documents themed around political and cultural events. They have compromised government and diplomatic organizations in multiple countries using adapted infection chains. The group uses Windows Shortcut (LNK), Microsoft Management Console Snap-In Control (MSC) files, and HTML files hosted on Microsoft Azure. They also use Cloudflare CDN to proxy command-and-control (C2) traffic to blend in with legitimate network activity, complicating victim identification.

The MirrorFace APT, linked to China, has been conducting extensive cyber espionage campaigns against Japan since 2019. The group uses malware delivered via email attachments, and exploits VPN vulnerabilities to steal sensitive information. Targets include the Japanese government, defense, aerospace, semiconductor, communications and research organizations. The group uses tools like ANEL and NOOPDOOR for its attacks. The campaign shows a deep focus on infiltrating Japanese national security and advanced technology sectors.

Chinese state-sponsored threat actors compromised the US Treasury Department by exploiting a vulnerability in a third-party software provider, BeyondTrust. The attackers accessed employee workstations and exfiltrated unclassified documents. This incident highlights the risk associated with third-party dependencies and supply chain attacks. The attackers gained remote access, raising concerns about the security posture of government agencies. The affected systems were not immediately identified but were confirmed to be workstations.

A critical vulnerability, tracked as CVE-2021-44207, in the Acclaim Systems USAHERDS web application, which is a web based application, has been actively exploited. The vulnerability involves the use of hard-coded credentials, making it an easy target for malicious actors. CISA has added this flaw to its Known Exploited Vulnerabilities catalog. Organizations are urged to apply the necessary remediation to reduce their exposure to cyber attacks. This vulnerability allows for significant risk to the federal enterprise.

A new mobile surveillance tool named ‘EagleMsgSpy’ has been discovered, used by Chinese law enforcement to gather data from Android devices. This tool, operational since 2017, collects a range of sensitive data, including chat messages, screen recordings, audio, call logs, contacts, SMS, location, and network activity. The collected data is sent to a command-and-control server, raising concerns about privacy and potential misuse.

Chinese hackers, likely associated with the Salt Typhoon group, used sophisticated methods to breach US telecommunication providers. The attack went beyond simple credential theft, indicating advanced techniques and significant compromise.

The FBI and CISA have jointly issued a warning about a significant cyber espionage campaign targeting US telecommunications infrastructure, allegedly orchestrated by Chinese-backed hackers. The campaign, which commenced in late October, has compromised the private communications of individuals, particularly those involved in government affairs. The extent of the breach and the specific methods employed by the attackers remain unclear, but the impact on US national security is substantial. This campaign underscores the growing threat posed by state-sponsored actors who leverage sophisticated cyber techniques to gather intelligence and influence political affairs. The compromised communications could be used to gain insights into government policies, strategies, and internal discussions, potentially giving the Chinese government a strategic advantage.

The China-linked Salt Typhoon hacking group successfully launched a cyber espionage campaign targeting major telecommunications companies AT&T and Verizon. The attackers aimed to gather foreign intelligence, although both companies have stated that their networks are now secure. This incident highlights the ongoing threat of state-sponsored cyber espionage targeting critical infrastructure and telecommunications providers. The initial breach was achieved by exploiting vulnerabilities in network infrastructure, and although the networks are now secure, it emphasizes the need for continuous monitoring and robust security measures to detect and mitigate these threats.