Featured

Chinese hacker group APT 41 has been in the news for multiple instances of cyberattacks, espionage, cyber piracy, and cybercrimes for at least a decade now. In 2022, however, APT 41’s activities have expanded significantly to net more data and geo-political leverage for its backers. This trend does have implications for governments and institutions of economic significance in various countries as they will now be targeted with multi-tactic and multi-platform tactics that will not just be hard to detect but hard to counter as well. While APT 27 the other Chinese APT group is now more or less focused on Taiwan and quite open (and vocal) with its threats, APT 41 has adopted an entirely different doctrine towards cyber espionage. Understanding APT 41’s information gathering approach rests on: APT 41 has been focusing a lot on intercepting government conversations, high-tech research, and select targets using spear phishing, listening,  water holes, RATs and backdoors, and communication chain attacks. The group specializes in attacks on large and tough-to-breach targets including telcos and defense projects. Its training regimen includes making trainees start their stint with APT 41 with first-level attacks on select Taiwanese targets. They are then deployed on select projects across South and South-East Asia. The group is also known to pursue subtle monetization options and has been known to sell stolen IP in closed forums through intermediaries. What APT 41 does with the money it earns is not fully known. While North Korean Lazarus is known to hand over its earnings to the government, some part of APT 41’s revenues may be shared with their handling agency within the Chinese government.      The economic threat from APT 41 The rising activity levels of APT 41 will eventually lead to an economic impact on various countries where its targets reside. APT 41 can theoretically connect attacks across critical infrastructures to create a single attack wave that causes business shutdowns, and exfiltration of confidential economic information including impending regulations or data that could lead to lowering of sentiment in the stock markets and pressures on the currency of countries. This wave could also degrade the ability of a nation to respond to an economic or military threat or an internal disturbance. Overall, such a destabilization could impact not just the target country but the region and many multilateral institutions as well. If the past attacks of APT 41 are anything to go by this group is being prepared for attaining much larger objectives of the government agencies that they report to.  The long-term stealthy intervention-driven network, communications, and asset reconnaissance point to a larger game plan.    Connect with Sectrio’s Cybersecurity Awareness Month initiatives to learn more about APT 41 and other threat actors. Want to learn more about OT and ICS security tactics and strategies? Speak to an OT security expert. Find out what is lurking in your network. Go for a comprehensive 3 layer threat assessment now See our OT security solution in action. Sign up for a free demo now. Get your free threat intelligence feeds here.   Understanding APT 41’s information gathering approach in 10 steps

Supply chains have become a preferential target for hackers. Government reports from the UK, USA and many other parts of the world confirm the growing attacks on supply chains impacting businesses and even government agencies. Such attacks often involve secondary or even tertiary targets that are attacked through a series of breaches across organizations connected through a supply chain How are supply chains targeted? A chain is only as strong as the weakest link and this adage is true even in the digital world. Hackers target supply chains by studying the entire supplier network for identifying weak points for entry into a network. This network is then used as a conduit to target networks belonging to other organizations upstream or downstream. A single breach could potentially expose a whole chain and many service providers. Also Read: Why Supply chain poisoning is an imminent concern Using specific data, hackers target multiple employees across various organizations. This is done through a phishing email or a waterhole attack. While earlier attacks were not targeted, most of the attacks we have seen this year are targeted at specific individuals and involve state-backed actors. The whole approach is more structured and organized and hackers are clear about what they are looking for or want from these organizations.   The ultimate targetsThe more sophisticated the hacker, the more distant would the ultimate target be. In the case of a large defense hardware manufacturer in Europe, the first point of entry for the hackers was a firmware-linked entity based in Asia. The hackers used the first breach to move across continents and more targets downstream till the ultimate target was breached nearly 11 months later. The target organizations and their supply chain connects are mapped and observed over a period of time before an attack attempt is made. Software supply chain cybersecurity tips from NSA and CISA, US Software supply chain compromise is a common form of supply chain attack. The most common compromise methods involve exploitation of inherent design flaws in the software, addition of vulnerable third-party components into a software product, breach and infiltration of multiple supplier’s networks with malicious code before the final software product being delivered, and injection of malicious software which is finally deployed by the customer. The U.S NSA and CISA recently shared tips to secure the entire software supply chain. This is certainly a welcome move. The recommendation document covers security across: The document states that “stakeholders must seek to mitigate security concerns specific to their area of responsibility. However, other concerns may require a mitigation approach that dictates a dependency on another stakeholder or a shared responsibility by multiple stakeholders”. This points to a collaborative approach towards identifying and mitigating threats within and outside a supplier’s own area of responsibility.  The document while articulating the need to focus on vulnerabilities, states “dependencies that are inadequately communicated or addressed may lead to vulnerabilities and the potential for compromise”. Areas where these types of vulnerabilities may exist include: We recommend that all supply chain entities across verticals read, understand, and adhere to these tips. It will go a long way in securing not just supply chains but also the entire digital footprint of various enterprises and governments.  Sectrio Learn more about supply chain security by interacting with our cybersecurity experts today Do a complete cyber threat assessment now to find out your security gaps   To learn how you can protect your business, book a free consulting appointment with our IoT and OT security experts and see our IoT and OT security solution in action now: Schedule a time now Try our threat intelligence feeds for free now: Sign up for free threat intelligence feeds today.

As per a series of conversations intercepted by Sectrio’s threat research team from various forums, China is learned to have identified Beijing-based APT 41 and Haikou, Hainan-based APT 40 as nodal cyber offense teams to initiate revenge attacks against many countries. Through these attacks, China may try to gain control over the narrative that has emerged in wake of the recent revelation of a large data breach that has impacted over a billion Chinese citizens. Who are the Chinese APT groups targeting? These attacks may primarily be aimed against countries with whom China has had an uneasy relationship in the past. It could also include a few other countries to enhance the magnitude of the breach and to bring in an element of plausible deniability. Understanding the Shanghai Police data leak incident It may be remembered that in one of these most expansive breaches reported so far, the data belonging to nearly a billion Chinese citizens was breached some time ago. The 23 TB of data, a sample of which was released online, belonging to the Shanghai police department includes names, phone numbers, government ID, and law enforcement reports of citizens. An extortion attempt was made and hackers who asked the Police department to pay $200,000 to prevent the data from being leaked to a wider audience. China is known to keep massive amounts of data concerning its citizens and persons of interest from around the world in databases with various levels of security. In this instance, it is claimed that while the database was protected, a dashboard linked to the database was not. Also read: How to get started with OT security On Friday, the site where the data was put for sale removed the post advertising the data for sale. The site however indicated that it has other databases that it is willing to sell to prospective buyers. The scale of the breach left many questions unanswered primarily regarding the security of information collected by the government. While it has not made any direct references to the breach, China did ask all public bodies and citizen information managers to secure all information submitted to the government so that people and businesses feel safe while sharing their data with the government of China or public bodies under it. In addition to increasing confidence in the government’s ability to securely harvest and store data, China is also getting ready to go on the offensive to prove that such breaches can happen to the citizens of any country. This will also help China downplay the gravity of the original event while offering Chinese social platforms a convenient diversionary topic to discuss. Gameplan Revenge China is planning to launch new ransomware families and multi-loader malware for this operation. The designated APT groups identified for this breach campaign are APT 40 and 41. APT 40 also goes by monikers BRONZE MOHAWK, FEVERDREAM, G0065, Gadolinium, GreenCrash, Hellsing, Kryptonite Panda, Leviathan, MUDCARP, Periscope, Temp.Periscope, and Temp.Jumper. In the past, it has targeted government agencies, healthcare facilities, AI-based projects and even scientific research. APT 40 is no stranger to harvesting stolen data and is known to maintain a long-term reconnaissance presence extending to many victims in countries considered to be adversaries by the PRC government. This also includes friendly countries that have signed up for the Belt and Road initiative and nations that have received aid from China in one form or another. Also read: Complete Guide to Cyber Threat Intelligence Feeds APT 40 actors often employ non-malicious tools in non-standard folders as part of an attack. Thus, if the location of a non-malicious tool is found to be non-standard, the tool becomes an IOC for a breach. The malware libraries used by APT 40 are often shared with other Chinese APT groups. Post-breach data is also shared with other groups as a standard practice. Beijing-based APT 41 AKA Double Dragon Barium, Winnti, Wicked Panda, Wicked Spider, TG-2633, Bronze Atlas, Red Kelpie, Blackfly) is known to have links with the Chinese Ministry of State Security (MSS). Between 2021 and the early months of 2022, this group is known to have conducted extensive operations against the governments of the US, Canada, a few NATO member states, and the UK. This group is known to have multiple breach tactics in its inventory and is hard to detect. This group also has the capacity to modify a malware post-injection to work in conjunction with the host environment and adapt to any changes that the victim may make to their networks. Also read: Why IoT Security is Important for Today’s Networks? Both these groups are well versed in large-scale data harvesting, processing, and transfer of data and are known to be among the most stealthy APT groups in China. This is why China has chosen them to carry out a series of revenge attacks across many countries. These attacks could occur as early as this month as China seeks to bury the Shanghai Police leak episode. The speed with which these actors were assigned to this project indicates a sense of urgency.   The gameplan: Learn more about these actors in our 2022 IoT and OT Threat Landscape Assessment Report Go for a complete threat assessment program now to learn about the threats lurking in your network Learn more about Key Advanced Persistent Threat (APT) Clusters Under Observation explained by Prayukth K V, Speaker & Published Author cybersecurity, CMO, Sectrio, the market leader in IoT, OT & IT Security.