Security News > 2022 > June > US: Chinese govt hackers breached telcos to snoop on network traffic
Several US federal agencies today revealed that Chinese-backed threat actors have targeted and compromised major telecommunications companies and network service providers to steal credentials and harvest data.
"Upon gaining an initial foothold into a telecommunications organization or network service provider, PRC state-sponsored cyber actors have identified critical users and infrastructure including systems critical to maintaining the security of authentication, authorization, and accounting," the advisory explains.
"Armed with valid accounts and credentials from the compromised RADIUS server and the router configurations, the cyber actors returned to the network and used their access and knowledge to successfully authenticate and execute router commands to surreptitiously route, capture, and exfiltrate traffic out of the network to actor-controlled infrastructure," the federal agencies added.
The three federal agencies said the following common vulnerabilities and exposures are the network device CVEs most frequently exploited by Chinese-backed state hackers since 2020.
The NSA, CISA, and the FBI also urge US and allied governments, critical infrastructure, and private industry organizations to apply a list of mitigation measures that would help decrease the risk of similar attacks breaching their networks.
The federal agencies advise organizations to apply security patches as soon as possible, disable unnecessary ports and protocols to shrink their attack surface, and replace end-of-life network infrastructure that no longer receives security patches.
News URL
Related news
- US says Chinese hackers breached multiple telecom providers (source)
- US, UK warn of Russian APT29 hackers targeting Zimbra, TeamCity servers (source)
- Chinese Nation-State Hackers APT41 Hit Gambling Sector for Financial Gain (source)
- Chinese Hackers Use CloudScout Toolset to Steal Session Cookies from Cloud Services (source)
- Microsoft: Chinese hackers use Quad7 botnet to steal credentials (source)
- Sophos reveals 5-year battle with Chinese hackers attacking network devices (source)
- Sophos Versus the Chinese Hackers (source)
- FBI Seeks Public Help to Identify Chinese Hackers Behind Global Cyber Intrusions (source)
- US indicts Snowflake hackers who extorted $2.5 million from 3 victims (source)
- Reminder: China-backed crews compromised 'multiple' US telcos in 'significant cyber espionage campaign' (source)