Security News > 2020 > March > Chinese Hackers Exploit Cisco, Citrix Flaws in Massive Espionage Campaign
Between Jan. 20 and March 11, researchers observed APT41 exploiting vulnerabilities in Citrix NetScaler/ADC, Cisco routers and Zoho ManageEngine Desktop Central as part of the widespread espionage campaign.
Starting on Jan. 20, researchers observed the threat group attempting to exploit the notorious flaw in Citrix Application Delivery Controller and Citrix Gateway devices revealed as a zero-day then patched earlier this year.
On Feb. 21, researchers next observed APT41 switching gears to exploit a Cisco RV320 router at a telecommunications organization.
The threat actors downloaded an executable and linkable format binary payload. Researchers aren't sure what specific exploit was used in this case, but pointed to a Metasploit module combining two CVEs to enable remote code execution on Cisco RV320 and RV325 small business routers.
The first lull, between Jan. 23 and Feb. 1, was likely related to the Chinese Lunar New Year holidays: "This has been a common activity pattern by Chinese APT groups in past years as well," said researchers.
News URL
https://threatpost.com/chinese-hackers-exploit-cisco-citrix-espionage/154133/
Related news
- Chinese hackers breach more US telecoms via unpatched Cisco routers (source)
- Chinese Hackers Exploit MAVInject.exe to Evade Detection in Targeted Cyber Attacks (source)
- Hackers exploit SimpleHelp RMM flaws to deploy Sliver malware (source)
- Hackers exploit Cityworks RCE bug to breach Microsoft IIS servers (source)
- XE Hacker Group Exploits VeraCore Zero-Day to Deploy Persistent Web Shells (source)
- Hackers Exploit Google Tag Manager to Deploy Credit Card Skimmers on Magento Stores (source)
- SonicWall firewall exploit lets hackers hijack VPN sessions, patch now (source)
- North Korean Hackers Exploit PowerShell Trick to Hijack Devices in New Cyberattack (source)
- FINALDRAFT Malware Exploits Microsoft Graph API for Espionage on Windows and Linux (source)
- RA World Ransomware Attack in South Asia Links to Chinese Espionage Toolset (source)