Hey, China. Maybe you should have held your hackers off for a bit while COVID-19 ravaged the planet. Just a suggestion Proving that no good crisis ever goes to waste, Chinese government hacking crew APT41 launched a campaign that abuses vulns in Citrix Netscaler and Zoho ManageEngine, according to threat intel outfit FireEye. As well as targeting load balancers and network management suites, the Chinese interference operatives spent three …
This post has been deleted by its author
"It is notable that we have only seen these exploitation attempts leverage publicly available malware such as Cobalt Strike and Meterpreter," commented FireEye. "While these backdoors are full featured, in previous incidents APT41 has waited to deploy more advanced malware until they have fully understood where they were and carried out some initial reconnaissance."
How very wise. And surely Most Commendable and Recommendable?
*Which may or may not yet be APT41 CyberIntelAIgent Intellectual Property for Hire and Bit Part Acquisition/Capitalised Purchase.
So basically they walked along the street and tried every door. If the door opened they would take a look at whose house it was before sending someone in to nick the TV/shit in the wardrobe?You're right, it could be a lot worse. ..... Anonymous Coward
No. It is much worse when they have they discovered your secret stash is clashing and clogging up their systems with fast foreign cash which they be minded to reinvest considerably better elsewhere, hence the occasional pause and change of tack in operations.
The Wild Wacky West though is hopelessly fated to be defaulted and configured for quarantine in the More of the Same Old Stuff for Further Past Nonsense Camp of Sub-Prime Executive Office Administrations ...... and that leaves one catastrophically vulnerable to exhaustive exploitation by practically everything new and/or almost new as in anything even slightly different and proving itself most attractive and appealing.
If that is wrong, there is much worse.
yes, uncovering their flaws will really SCREW your future "social credit" score.
Report them, and you'll end up in a burnt pile of bodies alongside former Wuhan district residents...
Conspiracy theory says it was all part of their plan, which has YET to completely backfire.
Given how many remote exploits there were for Cisco Kit in the last 30 days and how widely deployed they were, I would expect every country with sophisticated cyber capabilities to be making the most of the vulnerabilities before they got patched.
The US gov were so noisy about Chinese Huawei kit being vulnerable yet here we are with US Cisco kit having vulnerability after vulnerability and with proof they are being exploited.
Hacking is one of those jobs that can be done at home during isolation lockdown
For the love of dog, this is a tech site with seemingly intelligent people. You cannot attribute any hack to any state or person. In fact the way the internet works means it could literally be anyone. What if I relay through vpn's and compromised system to Scotland to perform an attack and use Scottish terms like deep fried bananas, kilt, bagpipe or "would you like a Glasgow kiss?" would that make me a Scottish hacker?
Having got that out of my system I will add that these clowns are nobs.
We know that outsourced Russian hackers are not allowed to use any Russian words or fonts in their code, so have to be careful to scrub usual fingerprints like home directories with Russian names that compilers like to stick in and such like.
We also know that the CIA have used Russian companies certificates in their malware and plant foreign language fingerprints like the above compiler home directories.
Not to mention all the stolen and re-used code from other countries cyber-offence teams. So yeah attribution is hard, so we have to go with best guess. It should be sold as definitive unless we are 100% and thats hard, even if we go by previous knowledge as again, that could be wrong for the same reason as above.
This post has been deleted by its author
am I allowed to say
NO, you are NOT allowed to say that... and I'm still laughing at your joke
(reminds me of an old 'book titles and authors' joke, something about a population explosion and 3 names commonly found in S.E. Asia, all strung together to make a funny phrase - a very very NAUGHTY funny phrase - rhyming with See Chuck's Tongue)
This post has been deleted by its author
"It is notable that we have only seen these exploitation attempts leverage publicly available malware such as Cobalt Strike and Meterpreter," commented FireEye. "While these backdoors are full featured, in previous incidents APT41 has waited to deploy more advanced malware until they have fully understood where they were and carried out some initial reconnaissance."
So it's not how APT41 but it is attributed to them? How very convenient to blame "the chinese virus".
TBH it sounds like a clumsy false flag operation. The chinese are currently making a major effort to regain lost face.
@Torchy: in which case, it'd be best not to buy anything. Because almost everything you buy will have components that originated life in that vast scumbag Communist state. . . a place, and a regime, whose existence is knowingly perpetuated by Big Commerce of a Capitalist West which wants the lowest manufacturing cost to maximize profit / executive pay / execuitve bonuses. If you want to change the way we do stuff, don't blame the Chinese or attempt to block 'em. Go after the major Western producers who, adly for them, wouldn't be able to make their $billions without cheap Chinese labour. And of course, when you've done that, and you wake up to the alarming discovery that the pension funds are no longer able to provide the returns they once did, maybe think again.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
