Tuesday, May 28, 2024

Chinese APT Hackers Launching Mass Cyber Attack Using Cisco, Citrix, Zoho Exploits to Hack Gov & Private Networks

APT 41, Chinese hackers groups launched a massive cyberattack on dozens of countries around the globe using exploits that trigger the vulnerabilities in Cisco, Citrix, Zoho products.

Several countries are being targeted including Australia, Canada, Denmark, Finland, France, India, Italy, Japan, Malaysia, Mexico, Philippines, Poland, Qatar, Saudi Arabia, Singapore, Sweden, Switzerland, UAE, UK, and USA.

There are 3 main products are being exploited in this attack, that are Citrix Application Delivery Controller, Cisco routers and Zoho ManageEngine Desktop Central. 

Attacker targeting several governments and private sectors including Healthcare, High Technology, Higher Education, Legal, Manufacturing, Media, Non-profit, Oil & Gas, Petrochemical, Pharmaceutical, Real Estate, Telecommunications, Transportation, Travel, and Utility.

Researchers from FireEye observed that the attack has been performed between January 20 and March 11.

Vulnerability Exploitation Details

This attack has been initially observed when threat actors attempted to exploit Citrix Application Delivery Controller (ADC) vulnerability CVE-2019-19781 on January 20, 2020. 

The exploitation attempt was involved execution of the command ‘file /bin/pwd’ that helps them to identify the vulnerable and patched system in the victim’s network.

In February, APT 41 actors start downloading the unknown payload from File Transfer Protocol (FTP) and the payload named “bsd” that looked like a backdoor.

According to the FireEye report “We observed a significant uptick in CVE-2019-19781 exploitation on February 24 and February 25. The exploit behavior was almost identical to the activity on February 1, where only the name of the payload ‘un’ changed.”

Exploiting Cisco Router

The researcher observed another successful exploitation attempt on Cisco RV320 routers that were deployed in telecommunications networks on Feb 21, 2020.

“It is unknown what specific exploit was used, but there is a Metasploit module that combines two CVE’s (CVE-2019-1653 and CVE-2019-1652) to enable remote code execution on Cisco RV320 and RV325 small business routers and uses wget to download the specified payload,” FireEye said.

APT 41

Exploiting Zoho ManageEngine Zero-Day Bug

APT actors another attack was targeted the several organizations that deployed Zoho ManageEngine Desktop Central versions before 10.0.474 (CVE-2020-10189) that contained a zero-day remote code execution vulnerability.

FireEye observed that APT41 use 91.208.184[.]78 to attempt to exploit the Zoho ManageEngine vulnerability at more than a dozen FireEye customers and five customers were reportedly compromised during the attempt.

APT 41 Attackers directly upload “logger.zip”, a simple Java-based program, which contained a set of commands to use PowerShell to download and execute install.bat and storesyncsvc.dll.

Also, the attackers leverage the Microsoft BITSAdmin command-line tool to download install.bat  that helps them to install persistence for a trial version of the Cobalt Strike BEACON loader.

The researcher believes that the BEACON shellcode that downloaded from the C2 server may be used to attempting to diversify post-exploitation access to the compromised systems.


Latest articles

DDNS Service In Fortinet Or QNAP Embedded Devices Exposes Sensitive Data, Researchers Warn

Hackers employ DNS for various purposes like redirecting traffic to enable man-in-the-middle attacks, infecting...

PoC Exploit Released For macOS Privilege Escalation Vulnerability

A new vulnerability has been discovered in macOS Sonoma that is associated with privilege...

CatDDoS Exploiting 80+ Vulnerabilities, Attacking 300+ Targets Daily

Malicious traffic floods targeted systems, servers, or networks in Distributed Denial of Service (DDoS)...

GNOME Remote Desktop Vulnerability Let Attackers Read Login Credentials

GNOME desktop manager was equipped with a new feature which allowed remote users to...

Kesakode: A Remote Hash Lookup Service To Identify Malware Samples

Today marks a significant milestone for Malcat users with the release of version 0.9.6,...

Cisco Firepower Vulnerability Let Attackers Launch SQL Injection Attacks

 A critical vulnerability has been identified in Cisco Firepower Management Center (FMC) Software's web-based...

Hackers Exploit WordPress Plugin to Steal Credit Card Data

Hackers have exploited an obscure WordPress plugin to inject malware into websites, specifically targeting...
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Free Webinar

Live API Attack Simulation

94% of organizations experience security problems in production APIs, and one in five suffers a data breach. As a result, cyber-attacks on APIs increased from 35% in 2022 to 46% in 2023, and this trend continues to rise.
Key takeaways include:

  • An exploit of OWASP API Top 10 vulnerability
  • A brute force ATO (Account Takeover) attack on API
  • A DDoS attack on an API
  • Positive security model automation to prevent API attacks

Related Articles