Source |
CybeReason |
Identifiant |
3164929 |
Date de publication |
2021-08-03 04:03:00 (vue: 2021-08-03 04:05:33) |
Titre |
DeadRinger: Exposing Chinese Threat Actors Targeting Major Telcos |
Texte |
Following the discovery of Hafnium attacks targeting Microsoft Exchange vulnerabilities, the Cybereason Nocturnus and Incident Response teams proactively hunted for various threat actors trying to leverage similar techniques in-the-wild. In the beginning of 2021, the Cybereason Nocturnus Team investigated clusters of intrusions detected targeting the telecommunications industry across Southeast Asia. During the investigation, three clusters of activity were identified and showed significant connections to known threat actors, all suspected to be operating on behalf of Chinese state interests.
The report comes on the heels of the Biden administration's public rebuke of China's Ministry of State Security for the recent HAFNIUM attacks that exploited vulnerabilities in unpatched Microsoft Exchange Servers and put thousands of organizations worldwide at risk. Exploitation of these same vulnerabilities were central to the success of the attacks detailed in this research. |
Notes |
|
Envoyé |
Oui |
Condensat |
2021 across activity actors administration all asia attacks beginning behalf biden central china chinese clusters comes connections cybereason deadringer: detailed detected discovery during exchange exploitation exploited exposing following hafnium heels hunted identified incident industry interests intrusions investigated investigation known leverage major microsoft ministry nocturnus operating organizations proactively public put rebuke recent report research response risk same security servers showed significant similar southeast state success suspected targeting team teams techniques telcos telecommunications these thousands threat three trying unpatched various vulnerabilities wild worldwide |
Tags |
Threat
|
Stories |
|
Move |
|