Chinese Cyber Espionage Targets Telecom Operators in Asia Since 2021

Cyber espionage groups affiliated with China have been connected to a lengthy-operating marketing campaign that has infiltrated a number of telecom operators located in a solitary Asian country at minimum because 2021.

“The attackers put backdoors on the networks of specific corporations and also tried to steal credentials,” the Symantec Risk Hunter Group, section of Broadcom, claimed in a report shared with The Hacker News.

The cybersecurity agency did not expose the place that was qualified, but claimed it observed proof to counsel that the destructive cyber exercise might have started as much back as 2020.

The attacks also qualified an unnamed solutions company that catered to the telecoms sector and a university in another Asian country, it added.

The option of equipment utilised in this campaign overlaps with other missions done by Chinese espionage groups like Mustang Panda (aka Earth Preta and Fireant), RedFoxtrot (aka Neeedleminer and Nomad Panda), and Naikon (aka Firefly) in latest decades.

This features custom backdoors tracked as COOLCLIENT, QuickHeal, and RainyDay that occur outfitted with capabilities to capture sensitive data and build interaction with a command-and-handle (C2) server.

Whilst the correct initial obtain pathway applied to breach the targets is presently unidentified, the marketing campaign is also noteworthy for deploying port scanning tools and conducting credential theft by the dumping of Windows Registry hives.

The fact that the tooling has connections to 3 unique adversarial collectives has raised several choices: The attacks are currently being conducted independently of each other, a solitary risk actor is making use of instruments acquired from other groups, or assorted actors are collaborating on a solitary marketing campaign.

Also unclear at this phase is the most important motive driving the intrusions, whilst Chinese menace actors have a history of focusing on the telecoms sector throughout the entire world.

In November 2023, Kaspersky revealed a ShadowPad malware marketing campaign concentrating on one particular of the nationwide telecom businesses of Pakistan by exploiting recognized security flaws in Microsoft Trade Server (CVE-2021-26855 aka ProxyLogon).

“The attackers may well have been accumulating intelligence on the telecoms sector in that region,” Symantec postulated. “Eavesdropping is one more likelihood. Alternatively, the attackers may perhaps have been making an attempt to develop a disruptive capacity in opposition to critical infrastructure in that state.”

Identified this short article interesting? Stick to us on Twitter  and LinkedIn to examine more unique material we post.

Some components of this short article are sourced from:
thehackernews.com