Tag

Nation State

All articles tagged with #nation state

technology1 month ago•7 min saved

FBI Dismantles Chinese State Proxy Network Used in Mass US Hacks

U.S. authorities disrupted two Chinese proxy tools, QTRouter and QScan, used by the QTFY hacking group tied to a Chinese state contractor to recruit IoT botnets and rented proxies for widespread intrusions into NASA, the Senate, the Federal Reserve, and other federal agencies and critical infrastructure; the takedown seizes key domains and disrupts VPN-based relay networks, signaling a significant setback for the attackers though experts say they will likely rebuild new infrastructure.

via WIRED|

#cybersecurity #fbi #hacking

technology8 months ago•3 min saved

Asia-based cyberespionage campaign breaches governments worldwide and expands reconnaissance

Palo Alto Networks Unit 42 reports an Asia-based cyberespionage group compromised at least 70 institutions across 37 governments and conducted reconnaissance in 155 countries. The attackers used phishing to drop a Cobalt Strike payload and a mix of exploits to gain footholds, with some victims accessed for months (including a parliament and key ministries). The operation is described as potentially the most widespread state-sponsored government breach since SolarWinds, with the group adapting to different targets and events and attribution to a specific country not determined.

via The Record from Recorded Future News|

#cyberespionage #governments #nation-state

cybersecurity11 months ago•4 min saved

Nation-State Airstalk Malware Uses Multi-Threaded C2 to Steal Windows Logins

A suspected nation-state threat actor has deployed a new malware called Airstalk, exploiting the AirWatch API for covert C2 communication, with variants capable of capturing browser data and executing various malicious tasks, potentially targeting enterprise sectors like BPO in a sophisticated supply chain attack.

via The Hacker News|

#airstalk #cybersecurity #enterprise-browsers

cybersecurity3 years ago•3 min saved

Long-standing vulnerability leads to multiple hacker groups breaching US federal agency.

Multiple threat actors, including one working for a nation-state, gained access to a US federal agency's network by exploiting a four-year-old vulnerability that remained unpatched. Both groups exploited a code-execution vulnerability tracked as CVE-2019-18935 in a developer tool known as the Telerik user interface (UI) for ASP.NET AJAX. The vulnerability was not detected for four years, and the agency's vulnerability scanner failed to detect it due to the Telerik UI software being installed in a file path it does not typically scan. The breach is the result of someone in the unnamed agency failing to install a patch that had been available for years.

via Ars Technica|

#cybersecurity #dll-side-loading #federal-agency