{"id":4166,"date":"2024-06-24T20:00:00","date_gmt":"2024-06-25T01:00:00","guid":{"rendered":"https:\/\/www.darkreading.com\/cyberattacks-data-breaches\/china-linked-espionage-groups-target-asian-telecoms"},"modified":"2024-06-24T20:00:00","modified_gmt":"2024-06-25T01:00:00","slug":"china-linked-cyber-espionage-teams-target-asian-telecoms","status":"publish","type":"post","link":"https:\/\/ddi.mohflo.net\/index.php\/2024\/06\/24\/china-linked-cyber-espionage-teams-target-asian-telecoms\/","title":{"rendered":"China-Linked Cyber-Espionage Teams Target Asian Telecoms"},"content":{"rendered":"
<\/a><\/div>\n
<\/div>\n

At least three cyber-espionage groups have compromised telecommunications operators in multiple countries in the Asia-Pacific region, placing backdoors inside the communications providers’ networks, stealing credentials, and using custom malware to gain control and compromise other systems, according to analyses published by two cybersecurity firms in the past week.<\/span><\/p>\n

Tools from a trio of China-linked groups \u2014 Fireant, Neeedleminer, and Firefly \u2014 were used to compromise telecommunications companies in at least two Asian nations, according to an analysis published by technology giant Broadcom’s Symantec cybersecurity division. The groups \u2014 also known as Mustang Panda, Nomad Panda, and Naikon, respectively \u2014 previously have been associated with widespread attacks against a variety of countries in the Asia-Pacific region.<\/span><\/p>\n

Attackers see telecommunications companies as a strong launchpad from which to compromise other systems, eavesdrop on communications, or cybercrime, says Dick O’Brien, principal threat intelligence analyst for Symantec’s threat hunter team.<\/span><\/p>\n

“There’s the potential for eavesdropping and surveillance but also, because telecoms is critical infrastructure, you could create significant disruption in your target country,” O’Brien says. “We think that there is a distinct possibility that the motive for these attacks was similar to what the US government has been repeatedly warning about.”<\/span><\/p>\n

In April, senior US officials warned that China-linked attackers had begun compromising critical infrastructure as a way to <\/span>pre-position<\/a><\/span> their offensive cyber operations for future conflicts. Japan and the Philippines created a trilateral alliance for <\/span>sharing information <\/a><\/span>on cyber threats, especially those from China. The alliance is similar to another trilateral information-sharing agreement between Japan and South Korea.<\/span><\/p>\n

The attacks come as other Asian nations continue to struggle with increasing cyberattacks. On June 24, Indonesia’s government acknowledged that cybercriminals had compromised its National Data Center and demanded an $8 million ransom. Rather than pay, the government is trying to recover, but <\/span>the attack has disrupted services for more than 200 agencies<\/a><\/span>.<\/span><\/p>\n

Taiwan is currently dealing with a spate of attacks by a Chinese state-sponsored group, dubbed RedJuliett, which has attacked 24 different government agencies, educational institutions, and technology firms, threat-intelligence firm Recorded Future stated in <\/span>an analysis published on June 24<\/a><\/span>.<\/span><\/p>\n

Cyberattackers Reach Out and Call<\/h2>\n

The focus on telecommunications companies is unsurprising: The infrastructure operators are the hub for most traffic on the Internet, making compromising their infrastructure extremely valuable, says Sergey Shykevich, threat intelligence group manager at cybersecurity firm Check Point Software.<\/span><\/p>\n

“The ultimate jackpot for an attacker with access to telecom networks is the CRM database of telco clients, allowing real-time access to SMS messages, locations, and other sensitive information,” he says. “Disruption of telecommunications companies can definitely be devastating for countries and users, as it happened just several month ago in Ukraine. However, in most instances, I believe the primary objective of targeting telecommunication companies is espionage and the valuable data they possess.”<\/span><\/p>\n

In October 2023, Check Point Research released details of an Iran-linked espionage campaign that had <\/span>primarily targeted government agencies and telecommunications providers<\/a><\/span>.<\/span><\/p>\n

Another example: Pakistan has become a focus of communications-based attacks, as the quickly digitalization of the country and its geopolitical environment has made it the leading target of reflection-based distributed denial-of-service (DDoS) attacks by a significant margin last year, says Donny Chong, director at Nexusguard, a Singapore-based firm focused on defenses against denial-of-service attacks.<\/span><\/p>\n

“The risk surrounding telecoms is that if you disrupt telecoms infrastructure, you also disrupt a lot of other critical infrastructure,” he says. “There are other sectors, too, which we frequently see targeted by application and multivector attacks \u2014 the tech, finance, banking, and insurance sectors in particular have had a hard time with these attacks.”<\/span><\/p>\n

Multiple Threat Groups<\/h2>\n

The attack on the unnamed Asian telecommunications firm included three custom attack tools, executing code in memory to avoid detection, and using legitimate software to load in malicious code \u2014 a technique known as sideloading. (Symantec would not name the targeted firms nor the two countries where they were investigating attacks.)<\/span><\/p>\n

The threat group, or groups, are relatively sophisticated, says Symantec’s O’Brien.<\/span><\/p>\n

“The fact that most of the payloads run in memory means that they can be difficult to detect,” he says. “The technique of sideloading using legitimate executables is favored by APT actors, presumably because the legitimate files they leverage are less likely to raise red flags.”<\/span><\/p>\n

The <\/span>analysis suggested<\/a><\/span> that, while the threat groups could be collaborating with one another \u2014 say, different arms of the Chinese government working together \u2014 other connections are possible, such as different groups using the same tools or a single group using all three tools.<\/span><\/p>\n

The connections between actors are often complicated. In 2021, a campaign of espionage attacks \u2014 <\/span>dubbed “Stayin’ Alive”<\/a><\/span> \u2014 targeted the telecommunications industry and governments of Vietnam, Uzbekistan, and Kazakhstan, using a simple downloader known as CurKeep. The attackers used the same infrastructure as a group known as<\/span> ToddyCat <\/a><\/span>by cybersecurity firm Kaspersky, which considers the threat actor fairly sophisticated.<\/span><\/p>\n

Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

At least three cyber-espionage groups have compromised telecommunications operators in<\/p>\n","protected":false},"author":12,"featured_media":4167,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[1],"tags":[809],"class_list":["post-4166","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-dark-reading"],"featured_image_urls":{"full":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/06\/china-linked-cyber-espionage-teams-target-asian-telecoms.jpg?fit=1920%2C1080&ssl=1",1920,1080,false],"thumbnail":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/06\/china-linked-cyber-espionage-teams-target-asian-telecoms.jpg?resize=150%2C150&ssl=1",150,150,true],"medium":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/06\/china-linked-cyber-espionage-teams-target-asian-telecoms.jpg?fit=300%2C169&ssl=1",300,169,true],"medium_large":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/06\/china-linked-cyber-espionage-teams-target-asian-telecoms.jpg?fit=640%2C360&ssl=1",640,360,true],"large":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/06\/china-linked-cyber-espionage-teams-target-asian-telecoms.jpg?fit=640%2C360&ssl=1",640,360,true],"1536x1536":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/06\/china-linked-cyber-espionage-teams-target-asian-telecoms.jpg?fit=1536%2C864&ssl=1",1536,864,true],"2048x2048":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/06\/china-linked-cyber-espionage-teams-target-asian-telecoms.jpg?fit=1920%2C1080&ssl=1",1920,1080,true],"chromenews-featured":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/06\/china-linked-cyber-espionage-teams-target-asian-telecoms.jpg?fit=1024%2C576&ssl=1",1024,576,true],"chromenews-large":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/06\/china-linked-cyber-espionage-teams-target-asian-telecoms.jpg?resize=825%2C575&ssl=1",825,575,true],"chromenews-medium":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/06\/china-linked-cyber-espionage-teams-target-asian-telecoms.jpg?resize=590%2C410&ssl=1",590,410,true]},"author_info":{"display_name":"Dark Reading","author_link":"https:\/\/ddi.mohflo.net\/index.php\/author\/darkreading\/"},"category_info":"Uncategorized<\/a>","tag_info":"Uncategorized","comment_count":"0","jetpack_featured_media_url":"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/06\/china-linked-cyber-espionage-teams-target-asian-telecoms.jpg?fit=1920%2C1080&ssl=1","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/4166","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/users\/12"}],"replies":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/comments?post=4166"}],"version-history":[{"count":0,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/4166\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/media\/4167"}],"wp:attachment":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/media?parent=4166"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/categories?post=4166"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/tags?post=4166"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}