Monday, November 25, 2024
HomeHacksChinese APT 10 Group Hacked Nearly 10 Telecom Networks and Stealing Users...

Chinese APT 10 Group Hacked Nearly 10 Telecom Networks and Stealing Users Call Records, PII, Credentials, Email Data and more

Published on

Infamous Chinese APT 10 hackers compromised over 10 Telecom networks around the world under the campaign called Operation Soft Cell and stealing various sensitive data including call records, PII, and attempting to steal all data stored in the active directory.

APT 10 Threat actors known as one of the sophisticated hacking group in the world and the group mostly targeting commercial activities including aviation, satellite, and maritime technology, industrial factory automation, finance, telecommunications and consumer electronics, computer processor technology, information technology services.

In 2018, Researchers from Cybereason initially identified this persistent attack that was primarily targeting the global telecommunication networks using various advanced Tools, Techniques, and procedures (TTPs) that never seen before.

- Advertisement - SIEM as a Service

Researchers refer this attack as “massive-scale” espionage which conducted against international Telecommunication Networks to steal all data stored in the active directory, compromising every single username and password in the organization, along with other personally identifiable information, billing data, call detail records, credentials, email servers, geo-location of users, and more.

Threat actors from ATP 10 involved in this massive campaign nearly past two years, and they keep on changing the attack patterns along with new activity every quarter.

Attack pattern changing every quarter

Researchers believe that APT 10 is entirely Chinese state-sponsored threat groups and their primary focus in telecom networks to obtain CDR data (call logs, cell tower locations, etc.)

How Does This Attack Start on Telecom Networks

Threat actors started gathering information about the network from the vulnerable publicly-facing server by executing a web shell.

Later, they attempted to compromise the most valuable critical assets, including Database servers, billing servers, and the active directory.

Several months later, researchers uncovered a second wave attack on Telecom networks with similar infiltration attempts but modified version of web shell and surveillance activities.

The initial indication was malicious web shell that identified on an IIS server with the process name w3wp.exe which is later confirmed that the web shell is a modified version of the China Chopper, a Web shell that initially discovered in 2012 used by Chinese threat actors to attack the enterprise web servers to gain remote access.

Threat actors launching the series of PowerShell commands on a compromised machine to enumerate the information about network architecture, users, and active directory.

Attackers also using nbtscan, a NetBIOS nameserver scanner to identify available NetBIOS name servers and scan the internal IP range of targeted Telecommunication network.

Maintain the Compromised Network Access

In order to maintain access to the compromised assets, threat actors deploy the dominant PoisonIvy RAT (PIVY), a Remote Access Trojan used by various APT groups incluuding APT10APT1, and DragonOK.

PoisonIvy RAT

PIVY is a very powerful RAT let hackers take complete control of the targeted Telecom networks machine and it has some important features including,

  • Registry Editor
  • Screenshot Grabber
  • Credential Stealer
  • Interactive Shell
  • File Manager with Upload and Download Support
  • Process Monitor
  • Keylogging and Various other Surveillance Features

According to Cybereason, One of the most valuable pieces of data that telecommunications providers hold is Call Detail Records (CDRs). CDRs are a large subset of metadata that contains all details about calls, including,

1.Source, Destination, and Duration of a Call
2.Device Details
3.Physical Location
4.Device Vendor and Version

“Having this information becomes particularly valuable when nation-state threat actors are targeting foreign intelligence agents, politicians, opposition candidates in an election, or even law enforcement”, Cybereason said.

Hacking Tools Used for this Campaign – Cybereason

  1. Web Shells
    • A modified version of the China Chopper web shell was used for initial compromise.
    • Custom-built web shells were used for later phases of the attack.
  2. Reconnaissance Tools
    • A modified version of Nbtscan was used to identify available NetBIOS name servers locally or over the network.
    • Multiple Windows built-in tools were used for various tasks, including whoami, net.exeipconfignetstatportqry, and more.
    • WMI and PowerShell commands were used for various tasks.
  3. RAT
    • PoisonIvy was used to maintain access across the compromised assets.
  4. Credential Dumpers
    • A modified version of Mimikatz was used to dump credentials stored on the compromised machines.
    • A PowerShell-based Mimikatz was also used to dump credentials stored on the compromised machines.
  5. Lateral movement
    • WMI was used for lateral movement.
    • PsExec was also used for lateral movement.
  6. Connection Proxy
    • A modified version of hTran was used to exfiltrate stolen data.
  7. Compression tool
    • Winrar was used to compress and password-protect stolen data.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates also you can take the Best Cybersecurity course online to keep yourself updated.

Also Read:

Chinese APT 10 Hackers Attack Government and Private Organizations Through Previously Unknown Malware

Chinese Hackers from APT 10 Hacking Group Charged for a Cyber Attack on NASA

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

Threat Actors Exploit Google Docs And Weebly Services For Malware Attacks

Phishing attackers used Google Docs to deliver malicious links, bypassing security measures and redirecting...

Python NodeStealer: Targeting Facebook Business Accounts to Harvest Login Credentials

The Python-based NodeStealer, a sophisticated info-stealer, has evolved to target new information and employ...

XSS Vulnerability in Bing.com Let Attackers Send Crafted Malicious Requests

A significant XSS vulnerability was recently uncovered in Microsoft’s Bing.com, potentially allowing attackers to...

Meta Removed 2 Million Account Linked to Malicious Activities

 Meta has announced the removal of over 2 million accounts connected to malicious activities,...

Free Webinar

Protect Websites & APIs from Malware Attack

Malware targeting customer-facing websites and API applications poses significant risks, including compliance violations, defacements, and even blacklisting.

Join us for an insightful webinar featuring Vivek Gopalan, VP of Products at Indusface, as he shares effective strategies for safeguarding websites and APIs against malware.

Discussion points

Scan DOM, internal links, and JavaScript libraries for hidden malware.
Detect website defacements in real time.
Protect your brand by monitoring for potential blacklisting.
Prevent malware from infiltrating your server and cloud infrastructure.

More like this

Threat Actors Exploit Google Docs And Weebly Services For Malware Attacks

Phishing attackers used Google Docs to deliver malicious links, bypassing security measures and redirecting...

Python NodeStealer: Targeting Facebook Business Accounts to Harvest Login Credentials

The Python-based NodeStealer, a sophisticated info-stealer, has evolved to target new information and employ...

Russian TAG-110 Hacked 60+ Users With HTML Loaded & Python Backdoor

The Russian threat group TAG-110, linked to BlueDelta (APT28), is actively targeting organizations in...