Security News > 2022 > June > U.S. Agencies Warn About Chinese Hackers Targeting Telecoms and Network Service Providers

U.S. cybersecurity and intelligence agencies have warned about China-based state-sponsored cyber actors leveraging network vulnerabilities to exploit public and private sector organizations since at least 2020.

The widespread intrusion campaigns aim to exploit publicly identified security flaws in network devices such as Small Office/Home Office routers and Network Attached Storage devices with the goal of gaining deeper access to victim networks.

The attacks themselves are facilitated by accessing compromised servers, which the agencies called hop points, from China-based IP addresses, using them to host C2 domains, email accounts, and communicate with the target networks.

"Cyber actors use these hop points as an obfuscation technique when interacting with victim networks," the agencies noted, detailing the adversary's pattern of weaponizing flaws in telecommunications organizations and network service providers.

Upon gaining a foothold into the network via an unpatched internet-facing asset, the actors have been observed obtaining credentials for user and administrative accounts, followed by running router commands to "Surreptitiously route, capture, and exfiltrate traffic out of the network to actor-controlled infrastructure."

The agencies did not single out a specific threat actor, but noted that the findings reflect Chinese state-sponsored groups' history of aggressively striking critical infrastructure to steal sensitive data, emerging key technologies, intellectual property, and personally identifiable information.

News URL

https://thehackernews.com/2022/06/us-agencies-warn-about-chinese-hackers.html