China-linked APT40's Swift Exploit Adaptation Triggers Cybersecurity Alerts
Cybersecurity agencies from Australia, Canada, Germany, Japan, New Zealand, South Korea, the U.K., and the U.S. have issued a warning about a China-linked hacking group called APT40. This group can exploit new security flaws very quickly, sometimes within hours or days of their discovery.
APT40 has targeted organizations in various countries, including Australia and the U.S. They are known for quickly adapting and using proof-of-concept vulnerabilities for attacks. This group, also called Bronze Mohawk, Gingham Typhoon, ISLANDDREAMS, Kryptonite Panda, Leviathan, Red Ladon, TA423, and TEMP.Periscope, has been active since at least 2011, focusing on the Asia-Pacific region and is believed to be based in Haikou.
In July 2021, the U.S. and its allies linked APT40 to China’s Ministry of State Security (MSS) and charged several members with stealing trade secrets, intellectual property, and other sensitive information.
Recently, APT40 has been connected to several cyber attacks, including using the ScanBox reconnaissance tool and exploiting a flaw in WinRAR (CVE-2023-38831, CVSS score: 7.8) in a phishing campaign in Papua New Guinea. In March, the New Zealand government blamed APT40 for compromising its Parliamentary Counsel Office and Parliamentary Service in 2021.
Source: Cybersecurity Agencies Warn of China-linked APT40's Rapid Exploit Adaptation (thehackernews.com
Done
July 11, 2024 00:25 (on 7/11/24)