Security News > 2021 > July > Hackers used SolarWinds zero-day bug to target US Defense orgs
China-based hackers actively target US defense and software companies using a vulnerability in the SolarWinds Serv-U FTP server.
Today, SolarWinds released a security update for a zero-day vulnerability in Serv-U FTP servers that allow remote code execution when SSH is enabled.
This threat group targets publicly exposed Serv-U FTP servers belonging to entities in the US Defense Industrial Base Sector and software companies.
"We observed DEV-0322 piping the output of their cmd.exe commands to files in the Serv-U ClientCommon folder, which is accessible from the internet by default, so that the attackers could retrieve the results of the commands," Microsoft explains in their blog post.
Microsoft says Serv-U users can check if their devices were compromised by checking the Serv-U DebugSocketLog.
A "C0000005; CSUSSHSocket::ProcessReceive" exception could indicate that the threat actors attempted to exploit the Serv-U server, but the exception could be shown for other reasons as well.
News URL
Related news
- CISA shares critical infrastructure defense tips against Chinese hackers (source)
- US Defense Dept received 50,000 vulnerability reports since 2016 (source)
- Hackers earn $1,132,500 for 29 zero-days at Pwn2Own Vancouver (source)
- US sanctions APT31 hackers behind critical infrastructure attacks (source)
- Hackers Hit Indian Defense, Energy Sectors with Malware Posing as Air Force Invite (source)
- A “cascade” of errors let Chinese hackers into US government inboxes (source)
- US Health Dept warns hospitals of hackers targeting IT help desks (source)
- Hackers Deploy Python Backdoor in Palo Alto Zero-Day Attack (source)
- MITRE says state hackers breached its network via Ivanti zero-days (source)
- ArcaneDoor hackers exploit Cisco zero-days to breach govt networks (source)