U.S. cybersecurity and intelligence agencies have warned about China-based state-sponsored cyber actors leveraging network vulnerabilities to exploit public and private sector organizations since at least 2020.
The widespread intrusion campaigns aim to exploit publicly identified security flaws in network devices such as Small Office/Home Office (SOHO) routers and Network Attached Storage (NAS) devices with the goal of gaining deeper access to victim networks.
In addition, the actors used these compromised devices as route command-and-control (C2) traffic to break into other targets at scale, the U.S. National Security Agency (NSA), the Cybersecurity and Infrastructure Security Agency (CISA), and the Federal Bureau of Investigation (FBI) said in a joint advisory.
The perpetrators, besides shifting their tactics in response to public disclosures, are known to employ a mix of open-source and custom tools for reconnaissance and vulnerability scanning as well as to obscure and blend their activity.
The attacks themselves are facilitated by accessing compromised servers, which the agencies called hop points, from China-based IP addresses, using them to host C2 domains, email accounts, and communicate with the target networks.
“Cyber actors use these hop points as an obfuscation technique when interacting with victim networks,” the agencies noted, detailing the adversary’s pattern of weaponizing flaws in telecommunications organizations and network service providers.
Upon gaining a foothold into the network via an unpatched internet-facing asset, the actors have been observed obtaining credentials for user and administrative accounts, followed by running router commands to “surreptitiously route, capture, and exfiltrate traffic out of the network to actor-controlled infrastructure.”
Last but not least, the attackers also modified or removed local log files to erase evidence of their activity to further conceal their presence and evade detection.
The agencies did not single out a specific threat actor, but noted that the findings reflect Chinese state-sponsored groups’ history of aggressively striking critical infrastructure to steal sensitive data, emerging key technologies, intellectual property, and personally identifiable information.
The disclosure also arrives less than a month after the cybersecurity authorities revealed the most routinely exploited initial access vectors to breach targets, some of which include misconfigured servers, weak password controls, unpatched software, and failure to block phishing attempts.
“Entities can mitigate the vulnerabilities listed in this advisory by applying the available patches to their systems, replacing end-of-life infrastructure, and implementing a centralized patch management program,” the agencies said.
