The FBI wants the public to help it track down Chinese hackers

Date:
Wed, 06 Nov 2024 14:46:20 +0000

Description:
The law enforcement agency is asking anyone with information to reach out via
WhatsApp or Telegram.

FULL STORY

The US Federal Bureau of Investigation (FBI) is asking the general public for
help in the investigation, and identification, of a threat actor targeting
edge devices and computer networks in government entities and other 
companies. 

Citing a report from cybersecurity researchers Sophos, the FBI said an
Advanced Persistent Threat (APT) group created and deployed malware as part 
of a widespread series of indiscriminate computer intrusions built to steal
sensitive information from firewalls worldwide. 

The campaign leveraged, first and foremost, CVE-2020-12271, an SQL injection
issue found in SFOS 17.0, 17.1, 17.5, and 18.0 before late April 2020, on
Sophos XG Firewall devices. The vulnerability affected devices configured 
with either the administration (HTTPS) service or the User Portal exposed on
the WAN zone. The crooks abused the bug to trigger remote code execution
(RCE), leading to the exfiltration of usernames and hashed passwords from
local device admins, portal admins, and user accounts. Years-long campaign 

The move is linked to a series of recent reports from Sophos which details
multiple hacking campaigns that took place between 2018 and 2023 and
apparently exploited edge infrastructure appliances to deploy custom malware.
Sophos dubbed the campaign Pacific Rim , and attributed it to multiple 
Chinese state-sponsored threat actors, including the infamous Volt Typhoon. 

Sophos also said that CVE-2020-12271 wasnt the only vulnerability exploited 
in this campaign, also listing CVE-2020-15069, CVE-2020-29574, CVE-2022-1040,
and CVE-2022-3236. 

"From 2021 onwards the adversaries appeared to shift focus from widespread
indiscriminate attacks to highly targeted, 'hands-on-keyboard' narrow-focus
attacks against specific entities: government agencies, critical
infrastructure, research and development organizations, healthcare providers,
retail, finance, military, and public-sector organizations primarily in the
Asia-Pacific region," the company said at the time. 

Those with actionable intel can reach out to the FBI via WhatsApp, Signal or
Telegram. 

 Via The Hacker News

======================================================================
Link to news story:
https://www.techradar.com/pro/security/the-fbi-wants-the-public-to-help-it-tra
ck-down-chinese-hackers

$$
--- SBBSecho 3.20-Linux