U.S. Agencies Warn About Chinese Hackers Targeting Telecoms and Network Service Providers

U.S. cybersecurity and intelligence agencies have warned^[1]
about China-based state-sponsored cyber actors leveraging network
vulnerabilities to exploit public and private sector organizations
since at least 2020.

The widespread intrusion campaigns aim to exploit publicly
identified security flaws in network devices such as Small
Office/Home Office (SOHO) routers and Network Attached Storage
(NAS) devices with the goal of gaining deeper access to victim
networks.

In addition, the actors used these compromised devices as route
command-and-control (C2) traffic to break into other targets at
scale, the U.S. National Security Agency (NSA), the Cybersecurity
and Infrastructure Security Agency (CISA), and the Federal Bureau
of Investigation (FBI) said^[2]
in a joint advisory.

The perpetrators, besides shifting their tactics in response to
public disclosures, are known to employ a mix of open-source and
custom tools for reconnaissance and vulnerability scanning as well
as to obscure and blend their activity.

The attacks themselves are facilitated by accessing compromised
servers, which the agencies called hop points, from China-based IP
addresses, using them to host C2 domains, email accounts, and
communicate with the target networks.

“Cyber actors use these hop points as an obfuscation technique
when interacting with victim networks,” the agencies noted,
detailing the adversary’s pattern of weaponizing flaws in
telecommunications organizations and network service providers.

Upon gaining a foothold into the network via an unpatched
internet-facing asset, the actors have been observed obtaining
credentials for user and administrative accounts, followed by
running router commands to “surreptitiously route, capture, and
exfiltrate traffic out of the network to actor-controlled
infrastructure.”

Last but not least, the attackers also modified or removed local
log files to erase evidence of their activity to further conceal
their presence and evade detection.

The agencies did not single out a specific threat actor, but
noted that the findings reflect Chinese state-sponsored groups’
history^[3]
of aggressively striking^[4]
critical infrastructure to steal sensitive data, emerging key
technologies, intellectual property, and personally identifiable
information.

The disclosure also arrives less than a month after the
cybersecurity authorities revealed^[5]
the most routinely exploited initial access vectors to breach
targets, some of which include misconfigured servers, weak password
controls, unpatched software, and failure to block phishing
attempts.

“Entities can mitigate the vulnerabilities listed in this
advisory by applying the available patches to their systems,
replacing end-of-life infrastructure, and implementing a
centralized patch management program,” the agencies said.