Friday, December 1, 2023

Chinese APT Hackers Launching Mass Cyber Attack Using Cisco, Citrix, Zoho Exploits to Hack Gov & Private Networks

APT 41, Chinese hackers groups launched a massive cyberattack on dozens of countries around the globe using exploits that trigger the vulnerabilities in Cisco, Citrix, Zoho products.

Several countries are being targeted including Australia, Canada, Denmark, Finland, France, India, Italy, Japan, Malaysia, Mexico, Philippines, Poland, Qatar, Saudi Arabia, Singapore, Sweden, Switzerland, UAE, UK, and USA.

There are 3 main products are being exploited in this attack, that are Citrix Application Delivery Controller, Cisco routers and Zoho ManageEngine Desktop Central. 

Attacker targeting several governments and private sectors including Healthcare, High Technology, Higher Education, Legal, Manufacturing, Media, Non-profit, Oil & Gas, Petrochemical, Pharmaceutical, Real Estate, Telecommunications, Transportation, Travel, and Utility.

Researchers from FireEye observed that the attack has been performed between January 20 and March 11.

Vulnerability Exploitation Details

This attack has been initially observed when threat actors attempted to exploit Citrix Application Delivery Controller (ADC) vulnerability CVE-2019-19781 on January 20, 2020. 

The exploitation attempt was involved execution of the command ‘file /bin/pwd’ that helps them to identify the vulnerable and patched system in the victim’s network.

In February, APT 41 actors start downloading the unknown payload from File Transfer Protocol (FTP) and the payload named “bsd” that looked like a backdoor.

According to the FireEye report “We observed a significant uptick in CVE-2019-19781 exploitation on February 24 and February 25. The exploit behavior was almost identical to the activity on February 1, where only the name of the payload ‘un’ changed.”

Exploiting Cisco Router

The researcher observed another successful exploitation attempt on Cisco RV320 routers that were deployed in telecommunications networks on Feb 21, 2020.

“It is unknown what specific exploit was used, but there is a Metasploit module that combines two CVE’s (CVE-2019-1653 and CVE-2019-1652) to enable remote code execution on Cisco RV320 and RV325 small business routers and uses wget to download the specified payload,” FireEye said.

APT 41

Exploiting Zoho ManageEngine Zero-Day Bug

APT actors another attack was targeted the several organizations that deployed Zoho ManageEngine Desktop Central versions before 10.0.474 (CVE-2020-10189) that contained a zero-day remote code execution vulnerability.

FireEye observed that APT41 use 91.208.184[.]78 to attempt to exploit the Zoho ManageEngine vulnerability at more than a dozen FireEye customers and five customers were reportedly compromised during the attempt.

APT 41 Attackers directly upload “”, a simple Java-based program, which contained a set of commands to use PowerShell to download and execute install.bat and storesyncsvc.dll.

Also, the attackers leverage the Microsoft BITSAdmin command-line tool to download install.bat  that helps them to install persistence for a trial version of the Cobalt Strike BEACON loader.

The researcher believes that the BEACON shellcode that downloaded from the C2 server may be used to attempting to diversify post-exploitation access to the compromised systems.


Latest articles

Hackers Using Weaponized Invoice to Deliver LUMMA Malware

Hackers use weaponized invoices to exploit trust in financial transactions, embedding malware or malicious...

US-Seized Crypto Currency Mixer Used by North Korean Lazarus Hackers

The U.S. Treasury Department sanctioned the famous cryptocurrency mixer Sinbad after it was claimed...

CISA Warns Hackers Exploiting Wastewater Systems Logic Controllers

In a disconcerting turn of events, cyber threat actors have set their sights on...

Zyxel Command Injection Flaws Let Attackers Run OS Commands

Three Command injection vulnerabilities have been discovered in Zyxel NAS (Network Attached Storage) products,...

North Korean Hackers Attacking macOS Using Weaponized Documents

Hackers often use weaponized documents to exploit vulnerabilities in software, which enables the execution...

Most Popular Websites Still Allow Users To Have Weak Passwords

The latest analysis shows that tens of millions of people are creating weak passwords...

Chrome Zero-Day Vulnerability That Exploited In The Wild

Google has fixed the sixth Chrome zero-day bug that was exploited in the wild this...
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

API Attack Simulation Webinar

Live API Attack Simulation

In the upcoming webinar, Karthik Krishnamoorthy, CTO and Vivek Gopalan, VP of Products at Indusface demonstrate how APIs could be hacked.The session will cover:an exploit of OWASP API Top 10 vulnerability, a brute force account take-over (ATO) attack on API, a DDoS attack on an API, how a WAAP could bolster security over an API gateway

Related Articles