17.5 C
Athens
Τετάρτη, 6 Νοεμβρίου, 2024

Microsoft Catches Chinese-Gov Hackers Targeting US Critical Infrastructure

Περισσότερα Νέα

- Advertisement -

Microsoft says it has caught Chinese state-backed hackers siphoning data from critical infrastructure organizations in Guam, a U.S. territory in the Pacific Ocean.

The discovery of Chinese-made cyberespionage malware in Guam is raising eyebrows because the tiny island is considered an important part of a future China/Taiwan military conflict.

Microsoft nicknamed the campaign Volt Typhoon and described it as “stealthy and targeted malicious activity focused on post-compromise credential access and network system discovery.”

“Microsoft assesses with moderate confidence that this [Chinese cyberespionage] campaign is pursuing development of capabilities that could disrupt critical communications infrastructure between the United States and Asia region during future crises,” the software giant said in a note documenting the APT discovery.

The U.S. government’s cybersecurity response agency CISA also issued an urgent bulletin on Wednesday calling attention to the threat actor and providing mitigation guidance, IOCs and other telemetry to help defenders hunt for signs of compromise.

- Advertisement -

Redmond said the group has been active since mid-2021 and has targeted critical infrastructure organizations in Guam and elsewhere in the United States.

The Chinese government hackers have hit a wide variety of organizations spanning communications, manufacturing, utility, transportation, construction, maritime, government, information technology, and the education sectors. 

“The threat actor intends to perform espionage and maintain access without being detected for as long as possible,” Microsoft said.

The hacking group breaks into target companies through internet-facing Fortinet FortiGuard devices and latches onto compromised small office/home office (SOHO) routers  to obfuscate the source of their activity.

“Microsoft has confirmed that many of the devices, which include those manufactured by ASUS, Cisco, D-Link, NETGEAR, and Zyxel, allow the owner to expose HTTP or SSH management interfaces to the internet. Owners of network edge devices should ensure that management interfaces are not exposed to the public internet in order to reduce their attack surface,” the company said.

“By proxying through these devices, Volt Typhoon enhances the stealth of their operations and lowers overhead costs for acquiring infrastructure.”

According to the report, the group primarily relies on so-called “living-off-the-land” commands to find information on the system, discover additional devices on the network, and exfiltrate data.

Preparing for future conflict?

“We recognize the actor from a series of intrusions that have targeted air, maritime, and land transportation targets, as well as other organizations,” John Hultquist, Chief Analyst at Google-owned Mandiant, told SecurityWeek. “There are a variety of reasons actors target critical infrastructure, but a persistent focus on these sectors may indicate preparation for disruptive or destructive cyberattack.”

While the discovery is alarming, Hultquist said activity like this does not mean attacks are inevitable.

“States conduct long-term intrusions into critical infrastructure to prepare for possible conflict, because it may simply be too late to gain access when conflict arises,” he said. “Similar contingency intrusions are regularly conducted by states. Over the last decade, Russia has targeted a variety of critical infrastructure sectors in operations that we do not believe were designed for immediate effect. China has done the same in the past, targeting the oil and gas sector.”

While Beijing’s operations are aggressive, Hultquist says they don’t necessarily indicate attacks are looming. “A far more reliable indicator for destructive and disruptive cyberattack is a deteriorating geopolitical situation. A destructive and disruptive cyberattack is not just a wartime scenario either. This capability may be used by states looking for alternatives to armed conflict.”

“Chinese cyberthreat actors are unique among their peers in that they have not regularly resorted to destructive and disruptive cyberattacks. As a result,” Hultquist said, “their capability is quite opaque.This disclosure is a rare opportunity to investigate and prepare for this threat.”

- Advertisement -

ΑΠΑΝΤΗΣΤΕ

εισάγετε το σχόλιό σας!
παρακαλώ εισάγετε το όνομά σας εδώ

The reCAPTCHA verification period has expired. Please reload the page.

Ροή ειδήσεων

ΣΧΕΤΙΚΑ ΑΡΘΡΑ

Pakistan is third worst nation globally in terms of law and order: World Justice Project index

In the latest World Justice Project (WJP) Rule of Law Index for 2024, Pakistan has been ranked 140th out of 142 countries, making it...

EU raises concern over Chinese aggression in Taiwan

The European Commission in a report raised concern over China's aggression against Taiwan and suggested that the EU step up exchanges with Taipei, Taipei...

Taiwan detects 6 Chinese military aircraft, 9 vessels around territory

Taiwan's Ministry of National Defence (MND) reported Chinese military activity near the island on Tuesday and said that by 6 am (local time), six...

China Tries to Blot out Tibetan Criticism of Mining Firm’s Damage to the Environment 

Chinese censors are trying to prevent people from viewing posts that allege severe environmental damage in Tibet caused by sand mining. A young Tibetan man...

ΔΗΜΟΦΙΛΗ ΑΡΘΡΑ

Οι πρώτες δηλώσεις του Ντόναλντ Τραμπ – «Πρόκειται για μία πολιτική νίκη που δεν έχει ξαναδεί η χώρα-Ξεκινά ο χρυσός αιώνας της Αμερικής»

Τραμπ: Θα πολεμήσω για εσάς «Θα πολεμήσω για τον κάθε πολίτη», τόνισε ο Ντόναλντ Τραμπ, προσθέτοντας: «Κάναμε μεγάλες νίκες και περιμένουμε να φτάσουμε τους 315...

Ντόναλντ Τραμπ: Σαρωτική η νίκη του και σε απόλυτο αριθμό ψήφων

Σαρωτική φαίνεται ότι θα είναι η νίκη του Ντόναλντ Τραμπ έναντι της Κάμαλα Χάρις στις αμερικανικές εκλογές της Τρίτης (5.11.24). Το προβάδισμα του Ντόναλντ Τραμπ...

Το Fox News ανακήρυξε νικητή τον Ντόναλντ Τραμπ – Από λεπτό σε λεπτό η ομιλία του – Έχει 265 εκλέκτορες με όριο νίκης τους...

Μετά την επικράτηση Τραμπ στην Πενσυλβάνια, ο υποψήφιος των Ρεπουμπλικανών έχει 265 εκλέκτορες με όριο νίκης τους 270 06/11/2024 09:09 Νίκη του Τραμπ στην Πενσυλβάνια προβλέπει...

Αμερικανικές εκλογές ΗΠΑ: Αγοραστική τρέλα για κρυπονομίσματα λόγω Τραμπ – Iστορικά υψηλά το bitcoin-Ο Ντόναλντ Τραμπ εξασφάλισε την Τζόρτζια

Το bitcoin εκτινάχθηκε σε υψηλό ρεκόρ όλων των εποχών στα 75.060 δολάρια, καθώς οι επενδυτές κρυπτονομισμάτων στοιχηματίζουν ότι ο Ντόναλντ Τραμπ θα είναι ο νικητής...