Tuesday, March 19, 2024

Chinese APT Hackers Launching Mass Cyber Attack Using Cisco, Citrix, Zoho Exploits to Hack Gov & Private Networks

APT 41, Chinese hackers groups launched a massive cyberattack on dozens of countries around the globe using exploits that trigger the vulnerabilities in Cisco, Citrix, Zoho products.

Several countries are being targeted including Australia, Canada, Denmark, Finland, France, India, Italy, Japan, Malaysia, Mexico, Philippines, Poland, Qatar, Saudi Arabia, Singapore, Sweden, Switzerland, UAE, UK, and USA.

There are 3 main products are being exploited in this attack, that are Citrix Application Delivery Controller, Cisco routers and Zoho ManageEngine Desktop Central. 

Attacker targeting several governments and private sectors including Healthcare, High Technology, Higher Education, Legal, Manufacturing, Media, Non-profit, Oil & Gas, Petrochemical, Pharmaceutical, Real Estate, Telecommunications, Transportation, Travel, and Utility.

Researchers from FireEye observed that the attack has been performed between January 20 and March 11.

Vulnerability Exploitation Details

This attack has been initially observed when threat actors attempted to exploit Citrix Application Delivery Controller (ADC) vulnerability CVE-2019-19781 on January 20, 2020. 

The exploitation attempt was involved execution of the command ‘file /bin/pwd’ that helps them to identify the vulnerable and patched system in the victim’s network.

In February, APT 41 actors start downloading the unknown payload from File Transfer Protocol (FTP) and the payload named “bsd” that looked like a backdoor.

According to the FireEye report “We observed a significant uptick in CVE-2019-19781 exploitation on February 24 and February 25. The exploit behavior was almost identical to the activity on February 1, where only the name of the payload ‘un’ changed.”

Exploiting Cisco Router

The researcher observed another successful exploitation attempt on Cisco RV320 routers that were deployed in telecommunications networks on Feb 21, 2020.

“It is unknown what specific exploit was used, but there is a Metasploit module that combines two CVE’s (CVE-2019-1653 and CVE-2019-1652) to enable remote code execution on Cisco RV320 and RV325 small business routers and uses wget to download the specified payload,” FireEye said.

APT 41

Exploiting Zoho ManageEngine Zero-Day Bug

APT actors another attack was targeted the several organizations that deployed Zoho ManageEngine Desktop Central versions before 10.0.474 (CVE-2020-10189) that contained a zero-day remote code execution vulnerability.

FireEye observed that APT41 use 91.208.184[.]78 to attempt to exploit the Zoho ManageEngine vulnerability at more than a dozen FireEye customers and five customers were reportedly compromised during the attempt.

APT 41 Attackers directly upload “logger.zip”, a simple Java-based program, which contained a set of commands to use PowerShell to download and execute install.bat and storesyncsvc.dll.

Also, the attackers leverage the Microsoft BITSAdmin command-line tool to download install.bat  that helps them to install persistence for a trial version of the Cobalt Strike BEACON loader.

The researcher believes that the BEACON shellcode that downloaded from the C2 server may be used to attempting to diversify post-exploitation access to the compromised systems.

Website

Latest articles

CryptoWire Ransomware Attacking Abuses Schedule Task To maintain Persistence

AhnLab security researchers detected a resurgence of CryptoWire, a ransomware strain originally prevalent in...

E-Root Admin Sentenced to 42 Months in Prison for Selling 350,000 Credentials

Tampa, FL – In a significant crackdown on cybercrime, Sandu Boris Diaconu, a 31-year-old...

WhiteSnake Stealer Checks for Mutex & VM Function Before Execution

A new variant of the WhiteSnake Stealer, a formidable malware that has been updated...

Researchers Hack AI Assistants Using ASCII Art

Large language models (LLMs) are vulnerable to attacks, leveraging their inability to recognize prompts...

Microsoft Deprecate 1024-bit RSA Encryption Keys in Windows

Microsoft has announced an important update for Windows users worldwide in a continuous effort...

Beware Of Free wedding Invite WhatsApp Scam That Steal Sensitive Data

The ongoing "free wedding invite" scam is one of several innovative campaigns aimed at...

Hackers Using Weaponized SVG Files in Cyber Attacks

Cybercriminals have repurposed Scalable Vector Graphics (SVG) files to deliver malware, a technique that...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles