Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

3/26/2020
08:40 AM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

China-Based Threat Group Launches Widespread Malicious Campaign

The motives behind the attacks remain unclear, but likely triggers include the ongoing trade war between the US and China and the unfolding COVID-19 pandemic.

APT41, a prolific advanced persistent threat group believed to be working on behalf of the Chinese government, has sharply ramped up its activities in recent months after a relative lull.

Researchers from FireEye who have been tracking the activity said APT41 attacked as many as 75 of its customers between January 20 and March 11 alone.

The targeted organizations are scattered across 20 countries, including the US, UK, Canada, Australia, France, Japan, and India. Organizations from nearly 20 sectors have been impacted, including those in the government, defense, banking, healthcare, pharmaceutical, and telecommunication sectors.

Though only a handful of the attacks resulted in an actual security compromise, FireEye described APT41's activity as one of the broadest malicious campaigns ever by a Chinese threat actor in recent years.

Chris Glyer, chief security architect at FireEye, says the reason for APT41's sudden burst of activity is unclear. Based on FireEye's current visibility, the attacks appear to be targeted, but it is hard to ascribe a specific motive or intent behind APT41's behavior, he says.

But likely triggers include the ongoing trade war between the US and China and the unfolding COVID-19 pandemic. It is possible that these events are driving China on a quest for intelligence on a variety of topics, including trade, travel, communications, manufacturing, research, and international relations.

"The most likely explanation for the broad targeting set is to enable both current as well as future potential collection requirements that would enable APT41 to complete their mission objectives quickly," Glyer says.

In several of the attacks, the threat actors attempted to exploit a previously known remote code execution flaw (CVE-2019-19781) in Citrix Application Delivery Controller (ADC) and Citrix Gateway devices. The flaw was first disclosed last December, and exploits for it became available this January. 

The flaw evoked considerable concern among security researchers because it impacted a Citrix technology that is widely deployed in enterprise settings and also because of how trivial it was to exploit. The concerns were exacerbated by the fact that exploits for the flaw became available before Citrix had a patch for it. Though Citrix and others, including the DHS's Cybersecurity and Infrastructure Security Agency (CISA), urged organizations to patch or otherwise protect against the flaw as soon as possible, many systems are believed to still be unpatched and vulnerable to the bug.

Dangerous Vulnerabilities
CVE-2019-19781 enables an attacker to execute arbitrary code on a vulnerable device, Glyer says. One of the worst-case scenarios would be an attacker compromising an ADC device, accessing credentials stored in the device, and then using the credentials and network access to move laterally and escalate privileges within a victim's internal network, he says.

According to Glyer, APT41 appears to have managed to successfully exploit the Citrix flaw at just one of the several organizations it targeted in its newest campaign.

In recent weeks FireEye researchers observed the China-based threat actor attempting to exploit a zero-day vulnerability [CVE-2020-10189] in Zoho ManageEngine. That flaw was disclosed earlier this month, and a proof-of-concept for exploiting it is already publicly available. FireEye counted attacks attempting to exploit the Zoho bug at more than a dozen of its customers. At least five of them were subsequently compromised and had malware installed on their systems.

In all of the exploitation attempts that FireEye observed, APT41 actors only leveraged publicly available tools, such as Cobalt Strike and Meterpreter, FireEye said in its report this week. In 2020, APT41 has emerged as one of the most active threat groups, Glyer says.

"APT41 is one of the most prolific and capable threat actors that we track," he says. "Organizations should take the information provided in the blog and evaluate whether they might have been targeted by APT41."

FireEye has previously described APT41 as a dual cybercrime and espionage group. Its espionage operations on behalf of the government in China have previously focused on healthcare, high tech, and the telecommunications sectors. APT41's modus operandi has typically been to break in, establish, and maintain strategic access on victim networks. The group's financially motivated cybercrime activities, on the other hand, have been purely for personal gain, FireEye said.

 Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's featured story: "What Should I Do If Someone Is Impersonating My Company in a Phishing Campaign?"

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
HackerOne Drops Mobile Voting App Vendor Voatz
Dark Reading Staff 3/30/2020
Limited-Time Free Offers to Secure the Enterprise Amid COVID-19
Curtis Franklin Jr., Senior Editor at Dark Reading,  3/31/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
State of Cybersecurity Incident Response
State of Cybersecurity Incident Response
Data breaches and regulations have forced organizations to pay closer attention to the security incident response function. However, security leaders may be overestimating their ability to detect and respond to security incidents. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-11565
PUBLISHED: 2020-04-06
An issue was discovered in the Linux kernel through 5.6.2. mpol_parse_str in mm/mempolicy.c has a stack-based out-of-bounds write because an empty nodelist is mishandled during mount option parsing, aka CID-aa9f7d5172fa.
CVE-2020-11558
PUBLISHED: 2020-04-05
An issue was discovered in libgpac.a in GPAC 0.8.0, as demonstrated by MP4Box. audio_sample_entry_Read in isomedia/box_code_base.c does not properly decide when to make gf_isom_box_del calls. This leads to various use-after-free outcomes involving mdia_Read, gf_isom_delete_movie, and gf_isom_parse_m...
CVE-2020-11547
PUBLISHED: 2020-04-05
PRTG Network Monitor before 20.1.57.1745 allows remote unauthenticated attackers to obtain information about probes running or the server itself (CPU usage, memory, Windows version, and internal statistics) via an HTTP request, as demonstrated by type=probes to login.htm or index.htm.
CVE-2020-11548
PUBLISHED: 2020-04-05
The Search Meter plugin through 2.13.2 for WordPress allows user input introduced in the search bar to be any formula. The attacker could achieve remote code execution via CSV injection if a wp-admin/index.php?page=search-meter Export is performed.
CVE-2020-11542
PUBLISHED: 2020-04-04
3xLOGIC Infinias eIDC32 2.213 devices with Web 1.107 allow Authentication Bypass via CMD.HTM?CMD= because authentication depends on the client side's interpretation of the <KEY>MYKEY</KEY> substring.