2024.07.09. The Fair Economy — The National Intelligence Service announced on the 9th that it, along with ASD's ACSC, the U.S. Cybersecurity and Infrastructure Security Agency (CISA), the National Security Agency (NSA), the Federal Bureau of Investigation (FBI), the UK's NCSC-UK, Canada's CCCS, New Zealand's NCSC-NZ, Germany's BND and BfV, Japan's NISC and the National Police Agency (NPA), issued a joint security advisory to raise awareness of APT40's cyberattacks, including two Australian victim cases.
APT40 is known as a hacking group backed by the Chinese Communist Party.
According to the joint advisory, APT40 — also known by the aliases Kryptonite Panda, GINGHAM TYPHOON, Leviathan and Bronze Mohawk — has the ability to quickly adapt to newly discovered vulnerabilities and immediately weaponize them against related infrastructure.
It also regularly seeks opportunities to infiltrate target networks of interest, such as national networks.
APT40 cyber actors periodically identify devices on networks of interest that are vulnerable, end-of-life, or no longer maintained or managed, and quickly exploit related vulnerabilities.
The group is characterized by rapidly exploiting new vulnerabilities in widely used software, such as Log4j (CVE-2021-44228), Atlassian Confluence (CVE-2021-26084), and Microsoft Exchange (CVE-2021-31207, CVE-2021-34523 and CVE-2021-34473).
Analysts say APT40 prefers exploiting vulnerable public-facing infrastructure over techniques that require user interaction, such as phishing attacks.
The advisory includes preventive measures alongside the Australian case studies.
The joint cybersecurity advisory has been posted on the websites of the participating agencies, including ASD's ACSC.
Meanwhile, according to multiple foreign media outlets including Australia's AAP and the UK's Financial Times (FT), ASD assessed in a technical advisory report that APT40 is based in Haikou, Hainan Province, China, and carries out "malicious cyber operations" on tasking from China's Ministry of State Security (MSS) and the Hainan State Security Department.
China, however, has pushed back against such reports, saying they "use cybersecurity issues as a pretext to smear and disparage China."
0 Comments
No comments yet.