logo
DATABASE RESOURCES PRICING ABOUT US

Potential for China Cyber Response to Heightened U.S.–China Tensions

2020-10-20T12:00:00

Description

### Summary _This Alert uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) framework. See the [ATT&CK for Enterprise](<https://attack.mitre.org/matrices/enterprise/>) framework for all referenced threat actor techniques._ _**Note**: on October 20, 2020, the National Security Agency (NSA) released a [cybersecurity advisory](<https://media.defense.gov/2020/Oct/20/2002519884/-1/-1/0/CSA_CHINESE_EXPLOIT_VULNERABILITIES_UOO179811.PDF>) providing information on publicly known vulnerabilities exploited by Chinese state-sponsored cyber actors to target computer networks holding sensitive intellectual property, economic, political, and military information. This Alert has been updated to include information on vulnerabilities exploited by Chinese state-sponsored actors (see Table 4)._ In light of heightened tensions between the United States and China, the Cybersecurity and Infrastructure Security Agency (CISA) is providing specific Chinese government and affiliated cyber threat actor tactics, techniques, and procedures (TTPs) and recommended mitigations to the cybersecurity community to assist in the protection of our Nation’s critical infrastructure. In addition to the recommendations listed in the Mitigations section of this Alert, CISA recommends organizations take the following actions. 1. **Adopt a state of heightened awareness. **Minimize gaps in personnel availability, consistently consume relevant threat intelligence, and update emergency call trees. 2. **Increase organizational vigilance.** Ensure security personnel monitor key internal security capabilities and can identify anomalous behavior. Flag any known Chinese indicators of compromise (IOCs) and TTPs for immediate response. 3. **Confirm reporting processes.** Ensure personnel know how and when to report an incident. The well-being of an organization’s workforce and cyber infrastructure depends on awareness of threat activity. Consider [reporting incidents](<https://us-cert.cisa.gov/report>) to CISA to help serve as part of CISA’s early warning system (see the Contact Information section below). 4. **Exercise organizational incident response plans.** Ensure personnel are familiar with the key steps they need to take during an incident. Do they have the accesses they need? Do they know the processes? Are various data sources logging as expected? Ensure personnel are positioned to act in a calm and unified manner. ### Technical Details #### China Cyber Threat Profile China has a history of using national military and economic resources to leverage offensive cyber tactics in pursuing its national interests. The “Made in China 2025” 10-year plan outlines China’s top-level policy priorities.[[1](<https://www.whitehouse.gov/wp-content/uploads/2018/06/FINAL-China-Technology-Report-6.18.18-PDF.pdf>)],[[2](<https://fas.org/sgp/crs/row/IF10964.pdf>)] China may seek to target the following industries deemed critical to U.S. national and economic interests: new energy vehicles, next generation information technology (IT), biotechnology, new materials, aerospace, maritime engineering and high-tech ships, railway, robotics, power equipment, and agricultural machinery.[[3](<https://www.cfr.org/backgrounder/made-china-2025-threat-global-trade>)] China has exercised its increasingly sophisticated capabilities to illegitimately obtain U.S. intellectual property (IP), suppress both social and political perspectives deemed dangerous to China, and harm regional and international opponents. The U.S. Intelligence Community and various private sector threat intelligence organizations have identified the Chinese People’s Liberation Army (PLA) and Ministry of State Security (MSS) as driving forces behind Chinese state-sponsored cyberattacks–either through contractors in the Chinese private sector or by the PLA and MSS entities themselves. China continues to engage in espionage-related activities that include theft of sensitive information such as innovation capital, IP, and personally identifiable information (PII). China has demonstrated a willingness to push the boundaries of their activities to secure information critical to advancing their economic prowess and competitive advantage. #### Chinese Cyber Activity According to open-source reporting, offensive cyber operations attributed to the Chinese government targeted, and continue to target, a variety of industries and organizations in the United States, including healthcare, financial services, defense industrial base, energy, government facilities, chemical, critical manufacturing (including automotive and aerospace), communications, IT, international trade, education, videogaming, faith-based organizations, and law firms. Additionally, numerous Department of Justice (DOJ) indictments over several years provide evidence to suggest Chinese threat actors continuously seek to illegally obtain and exfiltrate U.S. IP. Their targets also include western companies with operations inside China. Public reporting that associates Chinese actors with a range of high-profile attacks and offensive cyber activity includes: * **February 2013 – Cyber Threat Intelligence Researchers Link Advanced Persistent Threat (APT) 1 to China:** a comprehensive report publicly exposed APT1 as part of China’s military cyber operations and a multi-year effort that exfiltrated IP from roughly 141 companies spanning 20 major industries.[[4](<https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf>)] APT1 established access to the victims’ networks and methodically exfiltrated IP across a large range of industries identified in China’s 12th 5-Year Plan. A year later, the DOJ indicted Chinese cyber threat actors assigned to PLA Unit 61398 for the first time (also highlighted in the report).[[5](<https://www.justice.gov/opa/pr/us-charges-five-chinese-military-hackers-cyber-espionage-against-us-corporations-and-labor>)] * **April 2017 – Chinese APTs Targeting IP in 12 Countries:** CISA announced Chinese state-backed APTs carried out a multi-year campaign of cyber-enabled IP theft that targeted global technology service providers and their customers. The threat actors leveraged stolen administrative credentials (local and domain) and placed sophisticated malware on critical systems in an effort to steal the IP and sensitive data of companies located in at least 12 countries.[[6](<https://us-cert.cisa.gov/ncas/alerts/TA17-117A>)] * **December 2018 – Chinese Cyber Threat Actors Indicted for Compromising Managed Service Providers (MSPs):** DOJ indicted two Chinese cyber threat actors believed to be associated with APT10, who targeted MSPs and their large customer base through phishing and spearphishing campaigns aimed at exfiltrating sensitive business data and, possibly, PII.[[7](<https://www.justice.gov/opa/speech/deputy-attorney-general-rod-j-rosenstein-announces-charges-against-chinese-hackers>)] CISA also briefed stakeholders on Chinese APT groups who targeted MSPs and their customers to steal data and further operationalize commercial and economic espionage.[[8](<https://us-cert.cisa.gov/sites/default/files/publications/Chinese-Cyber-Activity-Targeting-Managed-Service-Providers.pdf>)] * **February 2020 – China’s Military Indicted for 2017 Equifax Hack:** DOJ indicted members of China’s PLA for stealing large amounts of PII and IP. The Chinese cyber threat actors exploited a vulnerability in the company’s dispute resolution website to enter the network, conduct reconnaissance, upload malware, and steal credentials to extract the targeted data. The breach impacted roughly half of all American citizens and stole Equifax’s trade secrets.[[9](<https://www.justice.gov/opa/speech/attorney-general-william-p-barr-announces-indictment-four-members-china-s-military>)] * **May 2020 – China Targets COVID-19 Research Organizations:** the Federal Bureau of Investigation (FBI) and CISA reported the targeting and compromise of U.S. organizations conducting COVID-19-related research by cyber actors affiliated with China.[[10](<https://www.cisa.gov/news/2020/05/13/fbi-and-cisa-warn-against-chinese-targeting-covid-19-research-organizations>)] Large-scale password spraying campaigns were a commonly observed tactic in illicitly obtaining IP related to vaccines, treatments, and testing from networks and personnel affiliated with COVID-19-related research.[[11](<https://us-cert.cisa.gov/ncas/alerts/AA20126A>)],[[12](<https://us-cert.cisa.gov/ncas/current-activity/2020/08/03/chinese-malicious-cyber-activity%20>)] #### Common TTPs of Publicly Known Chinese Threat Actors The section below provides common, publicly known, TTPs employed by Chinese threat actors, which map to the MITRE ATT&CK framework. Where possible, the tables include actions for detection and mitigation. This section is not exhaustive and does not detail all TTPs or detection and mitigation actions. #### PRE-ATT&CK TTPs Chinese threat actors commonly use the techniques listed in table 1 to achieve reconnaissance (_Technical Information Gathering_ [[TA0015](<https://attack.mitre.org/tactics/TA0015/>)]), staging (_Stage Capabilities_ [[TA0026](<https://attack.mitre.org/tactics/TA0026/>)]), and testing (_Test Capabilities_ [[TA0025](<https://attack.mitre.org/tactics/TA0025/>)]) before executing an attack. PRE-ATT&CK techniques can be difficult to detect and mitigate, however, defenders should be aware of the use of these techniques. _Table 1: Chinese threat actor PRE-ATT&CK techniques_ **Technique** | **Description** ---|--- _Acquire and/or Use 3rd Party Software Services_ [[T1330](<https://attack.mitre.org/techniques/T1330/>)] | Staging and launching attacks from software as a service solutions that cannot be easily tied back to the APT _Compromise 3rd Party Infrastructure to Support Delivery_ [[T1334](<https://attack.mitre.org/techniques/T1334/>)] | Compromising infrastructure owned by other parties to facilitate attacks (instead of directly purchasing infrastructure) _Domain Registration Hijacking_ [[T1326](<https://attack.mitre.org/techniques/T1326/>)] | Changing the registration of a domain name without the permission of its original registrant and then using the legitimate domain as a launch point for malicious purposes _Acquire Open-Source Intelligence (OSINT) Data Sets and Information_ [[T1247](<https://attack.mitre.org/techniques/T1247/>)] | Gathering data and information from publicly available sources, including public-facing websites of the target organization _Conduct Active Scanning _[[T1254](<https://attack.mitre.org/techniques/T1254/>)] | Gathering information on target systems by scanning the systems for vulnerabilities. Adversaries are likely using tools such as Shodan to identify vulnerable devices connected to the internet _Analyze Architecture and Configuration Posture _[[T1288](<https://attack.mitre.org/techniques/T1288/>)] | Analyzing technical scan results to identify architectural flaws, misconfigurations, or improper security controls in victim networks _Upload, Install, and Configure Software/Tools_ [[T1362](<https://attack.mitre.org/techniques/T1362>)] | Placing malware on systems illegitimately for use during later stages of an attack to facilitate exploitability and gain remote access #### Enterprise ATT&CK TTPs Chinese threat actors often employ publicly known TTPs against enterprise networks. To orchestrate attacks, they use commonly implemented security testing tools and frameworks, such as: * Cobalt Strike and Beacon * Mimikatz * PoisonIvy * PowerShell Empire * China Chopper Web Shell Table 2 lists common, publicly known, TTPs used by Chinese threat actors against enterprise networks and provides options for detection and mitigation based on the MITRE ATT&CK framework. _Table 2: Common Chinese threat actor techniques, detection, and mitigation_ **Technique / Sub-Technique** | **Detection** | **Mitigation** ---|---|--- _Obfuscated Files or Information _[[T1027](<https://attack.mitre.org/techniques/T1027/>)] | * Detect obfuscation by analyzing signatures of modified files. * Flag common syntax used in obfuscation. | * Use antivirus/antimalware software to analyze commands after processing. _Phishing: Spearphishing Attachment _[[T1566.001](<https://attack.mitre.org/techniques/T1566/001/>)] and _Spearphishing Link _[[T1566.002](<https://attack.mitre.org/techniques/T1566/002/>)] | * Use network intrusion detection systems (NIDS) and email gateways to detect suspicious attachments in email entering the network. * Use detonation chambers to inspect email attachments in isolated environments. | * Quarantine suspicious files with antivirus solutions. * Use network intrusion prevention systems to scan and remove malicious email attachments. * Train users to identify phishing emails and notify IT. _System Network Configuration Discovery_ [[T1016](<https://attack.mitre.org/techniques/T1016/>)] | * Monitor for processes and command-line arguments that could be used by an adversary to gather system and network information. | * This technique is difficult to mitigate with preventative controls; organizations should focus on detecting and responding to malicious activity to limit impact. _Command and Scripting Interpreter: Windows Command Shell _[[T1059.003](<https://attack.mitre.org/techniques/T1059/003/>)] | * Identify normal scripting behavior on the system then monitor processes and command-line arguments for suspicious script execution behavior. | * Only permit execution of signed scripts. * Disable any unused shells or interpreters. _User Execution: Malicious File _[[T1204.002](<https://attack.mitre.org/techniques/T1204/002/>)] | * Monitor execution of command-line arguments for applications (including compression applications) that may be used by an adversary to execute a user interaction. * Set antivirus software to detect malicious documents and files downloaded and installed on endpoints. | * Use execution prevention to prevent the running of executables disguised as other files. * Train users to identify phishing attacks and other malicious events that may require user interaction. _Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder _[[T1547.001](<https://attack.mitre.org/techniques/T1547/001/>)] | * Monitor the start folder for additions and changes. * Monitor registry for changes to run keys that do not correlate to known patches or software updates. | * This technique is difficult to mitigate with preventative controls; organizations should focus on detecting and responding to malicious activity to limit impact. _Command and Scripting Interpreter: PowerShell _[[T1059.001](<https://attack.mitre.org/techniques/T1059/001/>)] | * Enable PowerShell logging. * Monitor for changes in PowerShell execution policy as a method of identifying malicious use of PowerShell. * Monitor for PowerShell execution generally in environments where PowerShell is not typically used. | * Set PowerShell execution policy to execute only signed scripts. * Disable PowerShell if not needed by the system. * Disable WinRM service to help prevent use of PowerShell for remote execution. * Restrict PowerShell execution policy to administrators. _Hijack Execution Flow: DLL Side-Loading _[[T1574.002](<https://attack.mitre.org/techniques/T1574/002/>)] | * Track Dynamic Link Library (DLL) metadata, and compare DLLs that are loaded at process execution time against previous executions to detect usual differences unrelated to patching. | * Use the program `sxstrace.exe` to check manifest files for side-loading vulnerabilities in software. * Update software regularly including patches for DLL side-loading vulnerabilities. _Ingress Tool Transfer_ [[T1105](<https://attack.mitre.org/techniques/T1105/>)] | * Monitor for unexpected file creation or files transfer into the network from external systems, which may be indicative of attackers staging tools in the compromised environment. * Analyze network traffic for unusual data flows (i.e., a client sending much more data than it receives from a server). | * Use network intrusion detection and prevention systems to identify traffic for specific adversary malware or unusual data transfer over protocols such as File Transfer Protocol. _Remote System Discovery_ [[T1018](<https://attack.mitre.org/techniques/T1018/>)] | * Monitor processes and command-line arguments for actions that could be taken to gather system and network information. * In cloud environments, usage of commands and application program interfaces (APIs) to request information about remote systems combined with additional unexpected commands may be a sign of malicious use. | * This technique is difficult to mitigate with preventative controls; organizations should focus on detecting and responding to malicious activity to limit impact. _Software Deployment Tools_ [[T1072](<https://attack.mitre.org/techniques/T1072/>)] | * Identify the typical use pattern of third-party deployment software, then monitor for irregular deployment activity. | * Isolate critical network systems access using group policies, multi-factor authentication (MFA), and firewalls. * Patch deployment systems regularly. * Use unique and limited credentials for access to deployment systems. _Brute Force: Password Spraying_ [[T1110.003](<https://attack.mitre.org/techniques/T1110/003/>)] | * Monitor logs for failed authentication attempts to valid accounts. | * Use MFA. * Set account lockout policies after a certain number of failed login attempts. _Network Service Scanning_ [[T1046](<https://attack.mitre.org/techniques/T1046/>)] | * Use NIDS to identify scanning activity. | * Close unnecessary ports and services. * Segment network to protect critical servers and devices. _Email Collection _[[T1114](<https://attack.mitre.org/techniques/T1114/>)] | * Monitor processes and command-line arguments for actions that could be taken to gather local email files. | * Encrypt sensitive emails. * Audit auto-forwarding email rules regularly. * Use MFA for public-facing webmail servers. _Proxy: External Proxy_ [[T1090.002](<https://attack.mitre.org/techniques/T1090/002/>)] | * Analyze network data for uncommon data flows, such as a client sending significantly more data than it receives from an external server. | * Use NIDS and prevention systems to identify traffic for specific adversary malware using network signatures. _Drive-by Compromise _[[T1189](<https://attack.mitre.org/techniques/T1189/>)] | * Use Firewalls and proxies to inspect URLs for potentially known-bad domains or parameters. * Monitor network intrusion detection systems (IDS) to detect malicious scripts, and monitor endpoints for abnormal behavior. | * Isolate and sandbox impacted systems and applications to restrict the spread of malware. * Leverage security applications to identify malicious behavior during exploitation. * Restrict web-based content through ad-blockers and script blocking extensions. _Server Software Component: Web Shell_ [[T1505.003](<https://attack.mitre.org/techniques/T1505/003/>)] | * Analyze authentication logs, files, netflow/enclave netflow, and leverage process monitoring to discover anomalous activity. | * Patch vulnerabilities in internet facing applications. * Leverage file integrity monitoring to identify file changes. * Configure server to block access to the web accessible directory through principle of least privilege. _Application Layer Protocol: File Transfer Protocols _[[T1071.002](<https://attack.mitre.org/techniques/T1071/002/>)] and _DNS_ [[T1071.004](<https://attack.mitre.org/techniques/T1071/004/>)] | * Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). * Analyze packet contents to detect application layer protocols that do not follow the expected protocol standards regarding syntax, structure, or any other variable adversaries could leverage to conceal data. | * Leverage NIDS and NIPS using network signatures to identify traffic for specific adversary malware. #### Additional APT Activity The TTPs listed above have been repeatedly used across the spectrum of Chinese threat actors. The mitigations referenced in this alert can help reduce vulnerability to these TTPs; however, defenders should also maintain heightened awareness of threats actors that are more innovative in their approach, making it difficult to detect and respond to compromise. Publicly reported examples[[13](<https://www.fireeye.com/current-threats/apt-groups.html>)] include: * **APT3 **(known as UPS Team) is known for deploying zero-day attacks that target Internet Explorer, Firefox, and Adobe Flash Player. The group’s custom implants and changing Command and Control (C2) infrastructure make them difficult to track. APT3 exploits use Rivest Cypher 4 (RC4) encryption to communicate and bypass address space layout randomization (ASLR)/Data Execution Prevention (DEP) by using Return Oriented Programming (ROP) chains.[[14](<https://attack.mitre.org/groups/G0022/>)] * **APT10 **(known as MenuPass Group) has established accessed to victim networks through compromised service providers, making it difficult for network defenders to identify the malicious traffic. * **APT19** (known as Codoso and Deep Panda) is known for developing custom Rich Text Format (RTF) and macro-enabled Microsoft Office documents for both implants and payloads. The group has backdoored software, such as software serial generators, and has an elite use of PowerShell for C2 over Hyper Text Transfer Protocol (HTTP)/Hyper Text Transfer Protocol Secure (HTTPS).[[15](<https://attack.mitre.org/groups/G0073/>)] * **APT40** (known as Leviathan) has targeted external infrastructure with success, including internet-facing routers and virtual private networks. * **APT41 **(known as Double Dragon) has exploited vulnerabilities in Citrix NetScaler/ADC, Cisco routers, and Zoho ManageEngine Desktop Central to compromise victims.[[16](<https://attack.mitre.org/groups/G0096/>)] ### Mitigations ### Recommended Actions The following list provides actionable technical recommendations for IT security professionals to reduce their organization’s overall vulnerability. These recommendations are not exhaustive; rather they focus on the actions that will greatly reduce stakeholders’ attack surface. 1. **Patch systems and equipment promptly and diligently. **Establishing and consistently maintaining a thorough patching cycle continues to be the best defense against adversary TTPs. Focus on patching critical and high vulnerabilities that allow for remote code execution or denial-of-service on externally-facing (i.e., internet) equipment. Certain vulnerabilities—including CVE-2012-0158 in Microsoft products [[17](<https://us-cert.cisa.gov/ncas/alerts/aa20-133a%20>)], CVE-2019-19781 in Citrix devices [[18](<https://us-cert.cisa.gov/ncas/alerts/aa20-020a>)], and CVE-2020-5902 in BIG-IP Traffic Management User Interface [[19](<https://us-cert.cisa.gov/ncas/current-activity/2020/07/04/f5-releases-security-advisory-big-ip-tmui-rce-vulnerability-cve>)]—have presented APTs with prime targets to gain initial access. Chinese APTs often use existing exploit code to target routinely exploited vulnerabilities [[20](<https://us-cert.cisa.gov/ncas/alerts/aa20-133a%20>)], which present an opportunistic attack that requires limited resources. See table 3 for patch information on CVEs that have been routinely exploited by Chinese APTs. See table 4 for patch information on vulnerabilities that the National Security Agency (NSA) has stated are actively used by Chinese state-sponsored cyber actors. _Table 3: Patch information for vulnerabilities routinely exploited by Chinese APT actors_ **Vulnerability** | **Vulnerable Products** | **Patch Information** ---|---|--- [CVE-2012-0158](<https://nvd.nist.gov/vuln/detail/CVE-2012-0158>) | Microsoft Office 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1; Office 2003 Web Components SP3; SQL Server 2000 SP4, 2005 SP4, and 2008 SP2, SP3, and R2; BizTalk Server 2002 SP1; Commerce Server 2002 SP4, 2007 SP2, and 2009 Gold and R2; Visual FoxPro 8.0 SP1 and 9.0 SP2; and Visual Basic 6.0 | * [Microsoft Security Bulletin MS12-027: Vulnerability in Windows Common Controls Could Allow Remote Code Execution](<https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-027>) [CVE-2020-5902](<https://nvd.nist.gov/vuln/detail/CVE-2020-5902>) | * Big-IP devices (LTM, AAM, Advanced WAF, AFM, Analytics, APM, ASM, DDHD, DNS, FPS, GTM, Link Controller, PEM, SSLO, CGNAT) | * [F5 Security Advisory: K52145254: TMUI RCE vulnerability CVE-2020-5902](<https://support.f5.com/csp/article/K52145254>) [CVE-2019-19781](<https://nvd.nist.gov/vuln/detail/CVE-2019-19781>) | * Citrix Application Delivery Controller * Citrix Gateway * Citrix SDWAN WANOP | * [Citrix blog post: firmware updates for Citrix ADC and Citrix Gateway versions 11.1 and 12.0](<https://www.citrix.com/blogs/2020/01/19/vulnerability-update-first-permanent-fixes-available-timeline-accelerated/>) * [Citrix blog post: security updates for Citrix SD-WAN WANOP release 10.2.6 and 11.0.3](<https://www.citrix.com/blogs/2020/01/22/update-on-cve-2019-19781-fixes-now-available-for-citrix-sd-wan-wanop/>) * [Citrix blog post: firmware updates for Citrix ADC and Citrix Gateway versions 12.1 and 13.0](<https://www.citrix.com/blogs/2020/01/23/fixes-now-available-for-citrix-adc-citrix-gateway-versions-12-1-and-13-0/>) * [Citrix blog post: firmware updates for Citrix ADC and Citrix Gateway version 10.5](<https://www.citrix.com/blogs/2020/01/24/citrix-releases-final-fixes-for-cve-2019-19781/>) [CVE-2019-11510](<https://nvd.nist.gov/vuln/detail/CVE-2019-11510>) | * Pulse Connect Secure 9.0R1 - 9.0R3.3, 8.3R1 - 8.3R7, 8.2R1 - 8.2R12, 8.1R1 - 8.1R15 * Pulse Policy Secure 9.0R1 - 9.0R3.1, 5.4R1 - 5.4R7, 5.3R1 - 5.3R12, 5.2R1 - 5.2R12, 5.1R1 - 5.1R15 | * [Pulse Secure Out-of-Cycle Advisory: Multiple vulnerabilities resolved in Pulse Connect Secure / Pulse Policy Secure 9.0RX](<https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101>) [CVE-2019-16920](<https://nvd.nist.gov/vuln/detail/CVE-2019-16920>) | * D-Link products DIR-655C, DIR-866L, DIR-652, DHP-1565, DIR-855L, DAP-1533, DIR-862L, DIR-615, DIR-835, and DIR-825 | * [D-Link Security Advisory: DAP-1533 Rv Ax, DGL-5500 Rv Ax, DHP-1565 Rv Ax, DIR-130 Rv Ax, DIR-330 Rv Ax, DIR-615 Rv Ix, (non-US) DIR-652 Rv Bx, DIR-655 Rv Cx, DIR-825 Rv Cx, DIR-835 Rv Ax, DIR-855L Rv Ax, (non-US) DIR-862 Rv Ax, DIR-866L Rv Ax :: CVE-2019-16920 :: Unauthenticated Remote Code Execution (RCE) Vulnerability](<https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10124>) [CVE-2019-16278](<https://nvd.nist.gov/vuln/detail/CVE-2019-16278>) | * Nostromo 1.9.6 and below | * [Nostromo 1.9.6 Directory Traversal/ Remote Command Execution](<https://packetstormsecurity.com/files/155045/Nostromo-1.9.6-Directory-Traversal-Remote-Command-Execution.html>) * [Nostromo 1.9.6 Remote Code Execution](<https://packetstormsecurity.com/files/155802/nostromo-1.9.6-Remote-Code-Execution.html>) [CVE-2019-1652](<https://nvd.nist.gov/vuln/detail/CVE-2019-1652>) | * Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers | * [Cisco Security Advisory: Cisco Small Business RV320 and RV325 Routers Command Injection Vulnerability](<https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-rv-inject>) [CVE-2019-1653](<https://nvd.nist.gov/vuln/detail/CVE-2019-1653>) | * Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers | * [Cisco Security Advisory: Cisco Small Business RV320 and RV325 Routers Information Disclosure Vulnerability](<https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-rv-info>) [CVE-2020-10189](<https://nvd.nist.gov/vuln/detail/CVE-2020-10189>) | * Zoho ManageEngine Desktop Central before 10.0.474 | * [ManageEngine Desktop Central remote code execution vulnerability (CVE-2020-10189)](<https://www.manageengine.com/products/desktop-central/remote-code-execution-vulnerability.html>) _Table 4: Patch information for NSA listed vulnerabilities used by Chinese state-sponsored cyber actors [[21](<https://media.defense.gov/2020/Oct/20/2002519884/-1/-1/0/CSA_CHINESE_EXPLOIT_VULNERABILITIES_UOO179811.PDF>)]_ **Vulnerability** | **Vulnerable Products** | **Patch Information** ---|---|--- [CVE-2020-8193](<https://nvd.nist.gov/vuln/detail/CVE-2020-8193>) | * Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 * Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 | * [Citrix Security Bulletin CTX276688](<https://support.citrix.com/article/CTX276688>) [CVE-2020-8195](<https://nvd.nist.gov/vuln/detail/CVE-2020-8195>) | * Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 * Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 | * [Citrix Security Bulletin CTX276688](<https://support.citrix.com/article/CTX276688>) [CVE-2020-8196](<https://nvd.nist.gov/vuln/detail/CVE-2020-8196>) | * Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 * Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 | * [Citrix Security Bulletin CTX276688](<https://support.citrix.com/article/CTX276688>) [CVE-2019-0708](<https://nvd.nist.gov/vuln/detail/CVE-2019-0708>) | * Windows 7 for 32-bit Systems Service Pack 1 * Windows 7 for x64-based Systems Service Pack 1 * Windows Server 2008 for 32-bit Systems Service Pack 2 * Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) * Windows Server 2008 for Itanium-Based Systems Service Pack 2 * Windows Server 2008 for x64-based Systems Service Pack 2 * Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) * Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1 * Windows Server 2008 R2 for x64-based Systems Service Pack 1 * Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) | * [Microsoft Security Advisory for CVE-2019-0708](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0708>) [CVE-2020-15505](<https://nvd.nist.gov/vuln/detail/CVE-2020-15505>) | * MobileIron Core & Connector versions 10.3.0.3 and earlier, 10.4.0.0, 10.4.0.1, 10.4.0.2, 10.4.0.3, 10.5.1.0, 10.5.2.0 and 10.6.0.0 * Sentry versions 9.7.2 and earlier, and 9.8.0; * Monitor and Reporting Database (RDB) version 2.0.0.1 and earlier | * [MobileIron Blog: MobileIron Security Updates Available](<https://www.mobileiron.com/en/blog/mobileiron-security-updates-available>) [CVE-2020-1350](<https://nvd.nist.gov/vuln/detail/CVE-2020-1350>) | * Windows Server 2008 for 32-bit Systems Service Pack 2 * Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) * Windows Server 2008 for x64-based Systems Service Pack 2 * Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) * Windows Server 2008 R2 for x64-based Systems Service Pack 1 * Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) * Windows Server 2012 * Windows Server 2012 (Server Core installation) * Windows Server 2012 R2 * Windows Server 2012 R2 (Server Core installation) * Windows Server 2016 * Windows Server 2016 (Server Core installation) * Windows Server 2019 * Windows Server 2019 (Server Core installation) * Windows Server, version 1903 (Server Core installation) * Windows Server, version 1909 (Server Core installation) * Windows Server, version 2004 (Server Core installation) | * [Microsoft Security Advisory for CVE-2020-1350](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1350>) [CVE-2020-1472](<https://nvd.nist.gov/vuln/detail/CVE-2020-1472>) | * Windows Server 2008 R2 for x64-based Systems Service Pack 1 * Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) * Windows Server 2012 * Windows Server 2012 (Server Core installation) * Windows Server 2012 R2 * Windows Server 2016 * Windows Server 2019 * Windows Server 2019 (Server Core installation) * Windows Server, version 1903 (Server Core installation) * Windows Server, version 1909 (Server Core installation) * Windows Server, version 2004 (Server Core installation) | * [Microsoft Security Advisory for CVE-2020-1472](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1472>) [CVE-2020-1040](<https://nvd.nist.gov/vuln/detail/CVE-2020-1040>) | * Windows Server 2008 R2 for x64-based Systems Service Pack 1 * Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) * Windows Server 2012 * Windows Server 2012 (Server Core installation) * Windows Server 2012 R2 * Windows Server 2012 R2 (Server Core installation) * Windows Server 2016 * Windows Server 2016 (Server Core installation) | * [Microsoft Security Advisory for CVE-2020-1040](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1040>) [CVE-2018-6789](<https://nvd.nist.gov/vuln/detail/CVE-2018-6789>) | * Exim before 4.90.1 | * [Exim page for CVE-2020-6789](<https://exim.org/static/doc/security/CVE-2018-6789.txt>) * [Exim patch information for CVE-2020-6789](<https://git.exim.org/exim.git/commit/cf3cd306062a08969c41a1cdd32c6855f1abecf1>) [CVE-2020-0688](<https://nvd.nist.gov/vuln/detail/CVE-2020-0688>) | * Microsoft Exchange Server 2010 Service Pack 3 Update Rollup 30 * Microsoft Exchange Server 2013 Cumulative Update 23 * Microsoft Exchange Server 2016 Cumulative Update 14 * Microsoft Exchange Server 2016 Cumulative Update 15 * Microsoft Exchange Server 2019 Cumulative Update 3 * Microsoft Exchange Server 2019 Cumulative Update 4 | * [Microsoft Security Advisory for CVE-2020-0688](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0688>) [CVE-2018-4939](<https://nvd.nist.gov/vuln/detail/CVE-2018-4939>) | * ColdFusion Update 5 and earlier versions * ColdFusion 11 Update 13 and earlier versions | * [Adobe Security Bulletin APSB18-14](<https://helpx.adobe.com/security/products/coldfusion/apsb18-14.html>) [CVE-2015-4852](<https://nvd.nist.gov/vuln/detail/CVE-2015-4852>) | * Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 | * [Oracle Critical Patch Update Advisory - October 2016](<https://www.oracle.com/security-alerts/cpuoct2016.html>) [CVE-2020-2555](<https://nvd.nist.gov/vuln/detail/CVE-2020-2555>) | * Oracle Coherence product of Oracle Fusion Middleware Middleware; versions 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. | * [Oracle Critical Patch Update Advisory - January 2020](<https://www.oracle.com/security-alerts/cpujan2020.html>) [CVE-2019-3396](<https://nvd.nist.gov/vuln/detail/CVE-2019-3396>) | * Atlassian Confluence Server before version 6.6.12, from version 6.7.0 before 6.12.3, from version 6.13.0 before 6.13.3), and from version 6.14.0 before 6.14.2 | * [Jira Atlassian Confluence Sever and Data Center: Remote code execution via Widget Connector macro - CVE-2019-3396](<https://jira.atlassian.com/browse/CONFSERVER-57974>) [CVE-2019-11580](<https://nvd.nist.gov/vuln/detail/CVE-2019-11580>) | * Atlassian Crowd and Crowd Data Center from version 2.1.0 before 3.0.5, from version 3.1.0 before 3.1.6, from version 3.2.0 before 3.2.8, from version 3.3.0 before 3.3.5, and from version 3.4.0 before 3.4.4 | * [Jira Atlassian Crowd: Crowd - pdkinstall development plugin incorrectly enabled - CVE-2019-11580](<https://jira.atlassian.com/browse/CWD-5388>) [CVE-2020-10189](<https://nvd.nist.gov/vuln/detail/CVE-2020-10189>) | * Zoho ManageEngine Desktop Central before 10.0.474 | * [ManageEngine Desktop Central remote code execution vulnerability (CVE-2020-10189)](<https://www.manageengine.com/products/desktop-central/remote-code-execution-vulnerability.html>) [CVE-2019-18935](<https://nvd.nist.gov/vuln/detail/CVE-2019-18935>) | * Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 | * [Telerik: ASP.NET AJAX: Allows JavaScriptSerializer Deserialization](<https://www.telerik.com/support/kb/aspnet-ajax/details/allows-javascriptserializer-deserialization>) [CVE-2020-0601](<https://nvd.nist.gov/vuln/detail/CVE-2020-0601>) | * Windows 10 for 32-bit Systems * Windows 10 for x64-based Systems * Windows 10 Version 1607 for 32-bit Systems * Windows 10 Version 1607 for x64-based Systems * Windows 10 Version 1709 for 32-bit Systems * Windows 10 Version 1709 for ARM64-based Systems * Windows 10 Version 1709 for x64-based Systems * Windows 10 Version 1803 for 32-bit Systems * Windows 10 Version 1803 for ARM64-based Systems * Windows 10 Version 1803 for x64-based Systems * Windows 10 Version 1809 for 32-bit Systems * Windows 10 Version 1809 for ARM64-based Systems * Windows 10 Version 1809 for x64-based Systems * Windows 10 Version 1903 for 32-bit Systems * Windows 10 Version 1903 for ARM64-based Systems * Windows 10 Version 1903 for x64-based Systems * Windows 10 Version 1909 for 32-bit Systems * Windows 10 Version 1909 for ARM64-based Systems * Windows 10 Version 1909 for x64-based Systems * Windows Server 2016 * Windows Server 2016 (Server Core installation) * Windows Server 2019 * Windows Server 2019 (Server Core installation) * Windows Server, version 1803 (Server Core Installation) * Windows Server, version 1903 (Server Core installation) * Windows Server, version 1909 (Server Core installation) | * [Microsoft Security Advisory for CVE-2020-0601](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0601>) [CVE-2019-0803](<https://nvd.nist.gov/vuln/detail/CVE-2019-0803>) | * Windows 10 for 32-bit Systems * Windows 10 for x64-based Systems * Windows 10 Version 1607 for 32-bit Systems * Windows 10 Version 1607 for x64-based Systems * Windows 10 Version 1703 for 32-bit Systems * Windows 10 Version 1703 for x64-based Systems * Windows 10 Version 1709 for 32-bit Systems * Windows 10 Version 1709 for ARM64-based Systems * Windows 10 Version 1709 for x64-based Systems * Windows 10 Version 1803 for 32-bit Systems * Windows 10 Version 1803 for ARM64-based Systems * Windows 10 Version 1803 for x64-based Systems * Windows 10 Version 1809 for 32-bit Systems * Windows 10 Version 1809 for ARM64-based Systems * Windows 10 Version 1809 for x64-based Systems * Windows 7 for 32-bit Systems Service Pack 1 * Windows 7 for x64-based Systems Service Pack 1 * Windows 8.1 for 32-bit systems * Windows 8.1 for x64-based systems * Windows RT 8.1 * Windows Server 2008 for 32-bit Systems Service Pack 2 * Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) * Windows Server 2008 for Itanium-Based Systems Service Pack 2 * Windows Server 2008 for x64-based Systems Service Pack * Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) * Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1 * Windows Server 2008 R2 for x64-based Systems Service Pack 1 * Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) * Windows Server 2012 * Windows Server 2012 (Server Core installation) * Windows Server 2012 R2 * Windows Server 2012 R2 (Server Core installation) * Windows Server 2016 * Windows Server 2016 (Server Core installation) * Windows Server 2019 * Windows Server 2019 (Server Core installation) * Windows Server, version 1803 (Server Core Installation) | * [Microsoft Security Advisory for CVE-2019-0803](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0803>) [CVE-2017-6327](<https://nvd.nist.gov/vuln/detail/CVE-2017-6327>) | * Symantec Messaging Gateway before 10.6.3-267 | * [Broadcom Security Updates Detial for CVE-2017-6327 and CVE-2017-6328 ](<https://www.broadcom.com/support/security-center/securityupdates/detail?fid=security_advisory&pvid=security_advisory&year=&suid=20170810_00>) [CVE-2020-3118](<https://nvd.nist.gov/vuln/detail/CVE-2020-3118>) | * ASR 9000 Series Aggregation Services Routers * Carrier Routing System (CRS) * IOS XRv 9000 Router * Network Convergence System (NCS) 540 Series Routers * NCS 560 Series Routers * NCS 1000 Series Routers * NCS 5000 Series Routers * NCS 5500 Series Routers * NCS 6000 Series Routers | * [Cisco Security Advisory cisco-sa-20200205-iosxr-cdp-rce](<https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200205-iosxr-cdp-rce>) [CVE-2020-8515](<https://nvd.nist.gov/vuln/detail/CVE-2020-8515>) | * DrayTek Vigor2960 1.3.1_Beta, Vigor3900 1.4.4_Beta, and Vigor300B 1.3.3_Beta, 1.4.2.1_Beta, and 1.4.4_Beta devices | * [Draytek Security Advisory: Vigor3900 / Vigor2960 / Vigor300B Router Web Management Page Vulnerability (CVE-2020-8515)](<https://www.draytek.com/about/security-advisory/vigor3900-/-vigor2960-/-vigor300b-router-web-management-page-vulnerability-\(cve-2020-8515\)/>) 2. **Implement rigorous configuration management programs. **Audit configuration management programs to ensure they can track and mitigate emerging threats. Review system configurations for misconfigurations and security weaknesses. Implementing a robust configuration and patch management program hinders sophisticated APT operations by limiting the effectiveness of opportunistic attacks. 3. **Disable unnecessary ports, protocols, and services.** Review network security device logs and determine whether to shut off unnecessary ports and protocols. Monitor common ports and protocols for C2 activity. Turn off or disable any unnecessary services or functionality within devices (e.g., universal plug and play [UPnP], PowerShell). 4. **Enhance monitoring of network and email traffic.** Review network signatures and indicators for focused operations activities, monitor for new phishing themes, and adjust email rules accordingly. Follow best practices of restricting attachments via email. Ensure that log information is aggregated and correlated to enable maximum detection capabilities, with a focus on monitoring for account misuse. 5. **Use protection capabilities to stop malicious activity.** Implement antivirus software and other endpoint protection capabilities to automatically detect and prevent malicious files from executing. Use network intrusion detection and prevention systems to identify and prevent commonly employed adversarial malware and limit nefarious data transfers. ### Contact Information CISA encourages recipients of this report to contribute any additional information that they may have related to this threat. For any questions related to this report, please contact CISA at: * 1-888-282-0870 (From outside the United States: +1-703-235-8832) * [Central@cisa.dhs.gov](<mailto:Central@cisa.dhs.gov>) (UNCLASS) CISA encourages you to report any suspicious activity, including cybersecurity incidents, possible malicious code, software vulnerabilities, and phishing-related scams. Reporting forms can be found on the CISA homepage at <http://www.us-cert.cisa.gov/>. ### References [[1] White House Publication: How China’s Economic Aggression Threatens the Technologies and Intellectual Property of the United States and the World ](<https://www.whitehouse.gov/wp-content/uploads/2018/06/FINAL-China-Technology-Report-6.18.18-PDF.pdf>) [[2] Congressional Research Services: 'Made in China 2025' Industrial Policies: Issues for Congress ](<https://fas.org/sgp/crs/row/IF10964.pdf>) [[3] Council on Foreign Relations: Is ‘Made in China 2025’ a Threat to Global Trade ](<https://www.cfr.org/backgrounder/made-china-2025-threat-global-trade>) [[4] Mandiant: APT1 Exposing One of China’s Cyber Espionage Units ](<https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf>) [[5] U.S. Department of Justice (DOJ) Press Release: U.S. Charges Five Chinese Military Hackers for Cyber Espionage Against U.S. Corporations and a Labor Organization for Commercial Advantage](<https://www.justice.gov/opa/pr/us-charges-five-chinese-military-hackers-cyber-espionage-against-us-corporations-and-labor>) [[6] CISA Alert TA17-117A: Intrusions Affecting Multiple Victims Across Multiple Sectors](<https://us-cert.cisa.gov/ncas/alerts/TA17-117A>) [[7] DOJ Press Release: Deputy Attorney General Rod J. Rodenstein Announces Charges Against Chinese Hackers](<https://www.justice.gov/opa/speech/deputy-attorney-general-rod-j-rosenstein-announces-charges-against-chinese-hackers>) [[8] CISA Awareness Briefing: Chinese Cyber Activity Targeting Managed Service Providers](<https://us-cert.cisa.gov/sites/default/files/publications/Chinese-Cyber-Activity-Targeting-Managed-Service-Providers.pdf>) [[9] DOJ Press Release: Deputy Attorney General William P. Barr Announces Indictment of Four Members of China’s Military for Hacking into Equifax](<https://www.justice.gov/opa/speech/attorney-general-william-p-barr-announces-indictment-four-members-china-s-military>) [[10] CISA Press Release: FBI and CISA Warn Against Chinese Targeting of COVID-19 Research Organizations ](<https://www.cisa.gov/news/2020/05/13/fbi-and-cisa-warn-against-chinese-targeting-covid-19-research-organizations>) [[11] CISA Alert AA20-126A: APT Groups Target Healthcare and Essential Services](<https://us-cert.cisa.gov/ncas/alerts/AA20126A>) [[12] CISA Current Activity (CA): Chinese Malicious Cyber Activity](<https://us-cert.cisa.gov/ncas/current-activity/2020/08/03/chinese-malicious-cyber-activity>) [[13] FireEye Advanced Persistent Threat Groups](<https://www.fireeye.com/current-threats/apt-groups.html>) [[14] MITRE ATT&CK: APT3](<https://attack.mitre.org/groups/G0022/>) [[15] MITRE ATT&CK: APT19](<https://attack.mitre.org/groups/G0073/>) [[16] MITRE ATT&CK: APT41](<https://attack.mitre.org/groups/G0096/>) [[17] CISA Alert AA20-133A: Top 10 Routinely Exploited Vulnerabilities](<https://us-cert.cisa.gov/ncas/alerts/aa20-133a>) [[18] CISA Alert AA20-020A: Critical Vulnerability in Citrix Application Delivery Controller, Gateway, and SD-WAN WANOP](<https://us-cert.cisa.gov/ncas/alerts/aa20-020a>) [[19] CISA CA: F5 Releases Security Advisory for BIP-IP TMUI RCE Vulnerability, CVE-2020-5902](<https://us-cert.cisa.gov/ncas/current-activity/2020/07/04/f5-releases-security-advisory-big-ip-tmui-rce-vulnerability-cve>) [[20] CISA Alert AA20-133A: Top 10 Routinely Exploited Vulnerabilities](<https://us-cert.cisa.gov/ncas/alerts/aa20-133a>) [[21] NSA Advisory: Chinese State-Sponsored Actors Exploit Publicly Known Vulnerabilities](<https://media.defense.gov/2020/Oct/20/2002519884/-1/-1/0/CSA_CHINESE_EXPLOIT_VULNERABILITIES_UOO179811.PDF>) ### Revisions October 1, 2020: Initial Version|October 20, 2020: Recommended Actions Section Updated


Related


threatpost
info

Bug Parade: NSA Warns on Cresting China-Backed Cyberattacks

2020-10-21T20:31:17
threatpost
info

Pioneer Kitten APT Sells Corporate Network Access

2020-09-01T13:35:19
threatpost
info

Election Systems Under Attack via Microsoft Zerologon Exploits

2020-10-13T16:39:01
threatpost
info

Feds Warn Nation-State Hackers are Actively Exploiting Unpatched Microsoft Exchange, F5, VPN Bugs

2020-09-14T21:20:46
threatpost
info

Top CVEs Trending with Cybercriminals

2021-07-16T21:07:15
threatpost
info

Chinese Hackers Exploit Cisco, Citrix Flaws in Massive Espionage Campaign

2020-03-25T15:57:25
threatpost
info

BlueKeep 'Mega-Worm' Looms as Fresh PoC Shows Full System Takeover

2019-06-05T14:14:47
threatpost
info

Active Scans Target Vulnerable Cisco Routers for Remote Code-Execution

2019-01-28T16:04:07
threatpost
info

Critical MobileIron RCE Flaw Under Active Attack

2020-11-25T16:55:48
threatpost
info

Microsoft Tackles Election Security with Bug Bounties

2019-10-18T20:04:29
threatpost
info

Critical Zoho Zero-Day Flaw Disclosed

2020-03-06T16:53:00
threatpost
info

PHP Bug Allows Remote Code-Execution on NGINX Servers

2019-10-28T16:18:11
threatpost
info

D-Link, IoT Devices Under Attack By Tor-Based Gafgyt Variant

2021-03-05T15:55:41
threatpost
info

Citrix Bugs Allow Unauthenticated Code Injection, Data Theft

2020-07-07T14:44:30
threatpost
info

Hackers Look to Steal COVID-19 Vaccine Research

2020-07-16T18:05:20
threatpost
info

Cisco Finally Patches Router Bugs As New Unpatched Flaws Surface

2019-04-05T20:29:09
qualysblog
blog

NSA Alert: Chinese State-Sponsored Actors Exploit Known Vulnerabilities

2020-10-22T23:10:29
qualysblog
blog

Solorigate/Sunburst : Theft of Cybersecurity Tools | FireEye Breach

2020-12-10T00:48:29
qualysblog
blog

Russia-Ukraine Crisis: How to Strengthen Your Security Posture to Protect against Cyber Attack, based on CISA Guidelines

2022-02-26T20:20:32
ics
info

Chinese Ministry of State Security-Affiliated Cyber Threat Actor Activity

2020-10-24T12:00:00
ics
info

Chinese State-Sponsored Cyber Operations: Observed TTPs

2021-08-20T12:00:00
ics
info

Iran-Based Threat Actor Exploits VPN Vulnerabilities

2020-09-15T12:00:00
ics
info

APT Actors Chaining Vulnerabilities Against SLTT, Critical Infrastructure, and Elections Organizations

2020-10-24T12:00:00
ics
info

Continued Threat Actor Exploitation Post Pulse Secure VPN Patching

2020-10-24T12:00:00
ics
info

Detecting Citrix CVE-2019-19781

2020-05-21T12:00:00
ics
info

APT Groups Target Healthcare and Essential Services

2022-01-25T12:00:00
ics
info

Russian State-Sponsored Advanced Persistent Threat Actor Compromises U.S. Government Targets

2020-12-01T12:00:00
ics
info

Threat Actor Exploitation of F5 BIG-IP CVE-2020-5902

2020-07-24T12:00:00
ics
info

Continued Exploitation of Pulse Secure VPN Vulnerability

2020-04-15T12:00:00
ics
info

Iranian Government-Sponsored Actors Conduct Cyber Operations Against Global Government and Commercial Networks

2022-02-24T12:00:00
ics
info

Microsoft Operating Systems BlueKeep Vulnerability

2019-06-17T12:00:00
ics
info

COVID-19 Exploited by Malicious Cyber Actors

2020-04-08T12:00:00
ics
info

Critical Vulnerability in Citrix Application Delivery Controller, Gateway, and SD-WAN WANOP

2020-05-21T12:00:00
ics
info

Russian Foreign Intelligence Service (SVR) Cyber Operations: Trends and Best Practices for Network Defenders

2021-04-26T12:00:00
ics
info

#StopRansomware: BianLian Ransomware Group

2023-05-16T12:00:00
ics
info

Iranian Advanced Persistent Threat Actors Threaten Election-Related Systems

2020-10-22T12:00:00
ics
info

#StopRansomware: Cuba Ransomware

2023-01-05T12:00:00
ics
info

#StopRansomware: MedusaLocker

2022-08-11T12:00:00
ics
info

Ransomware Awareness for Holidays and Weekends

2022-02-10T12:00:00
ics
info

Strengthening Cybersecurity of SATCOM Network Providers and Customers

2022-05-10T12:00:00
ics
info

Tactics, Techniques, and Procedures of Indicted APT40 Actors Associated with China’s MSS Hainan State Security Department

2021-07-20T12:00:00
ics
info

Malicious Cyber Actor Spoofing COVID-19 Loan Relief Webpage via Phishing Emails

2020-08-14T12:00:00
ics
info

Emotet Malware

2020-10-24T12:00:00
ics
info

Potential for Iranian Cyber Response to U.S. Military Strike in Baghdad

2020-10-24T12:00:00
ics
info

SamSam Ransomware

2018-12-03T12:00:00
ics
info

Enhanced Monitoring to Detect APT Activity Targeting Outlook Online

2023-07-12T12:00:00
ics
info

#StopRansomware: Daixin Team

2022-10-26T12:00:00
ics
info

New Sandworm Malware Cyclops Blink Replaces VPNFilter

2022-02-23T12:00:00
ics
info

Microsoft Office 365 Security Recommendations

2020-04-29T12:00:00
ics
info

Enterprise VPN Security

2020-04-15T12:00:00
ics
info

Ransomware Impacting Pipeline Operations

2020-10-24T12:00:00
ics
info

FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks

2020-10-24T12:00:00
ics
info

BlackMatter Ransomware

2021-10-18T12:00:00
ics
info

Protecting Against Cyber Threats to Managed Service Providers and their Customers

2022-05-11T12:00:00
ics
info

Russian State-Sponsored and Criminal Cyber Threats to Critical Infrastructure

2022-05-09T12:00:00
ics
info

TraderTraitor: North Korean State-Sponsored APT Targets Blockchain Companies

2022-04-20T12:00:00
ics
info

#StopRansomware: Royal Ransomware

2023-03-02T12:00:00
ics
info

#StopRansomware: Snatch Ransomware

2023-09-20T12:00:00
ics
info

Ongoing Cyber Threats to U.S. Water and Wastewater Systems

2021-10-25T12:00:00
ics
info

Ransomware Activity Targeting the Healthcare and Public Health Sector

2020-11-02T12:00:00
ics
info

Phishing Emails Used to Deploy KONNI Malware

2020-10-24T12:00:00
ics
info

Advanced Persistent Threat Actors Targeting U.S. Think Tanks

2020-12-01T12:00:00
ics
info

Detecting Post-Compromise Threat Activity Using the CHIRP IOC Detection Tool

2021-04-15T12:00:00
ics
info

TrickBot Malware

2021-05-20T12:00:00
ics
info

AppleJeus: Analysis of North Korea’s Cryptocurrency Malware

2021-04-15T12:00:00
ics
info

Detecting Post-Compromise Threat Activity in Microsoft Cloud Environments

2021-04-15T12:00:00
ics
info

New Exploits for Unsecure SAP Systems

2019-05-03T12:00:00
ics
info

DNS Infrastructure Hijacking Campaign

2019-02-13T12:00:00
ics
info

Understanding and Mitigating Russian State-Sponsored Cyber Threats to U.S. Critical Infrastructure

2022-03-01T12:00:00
ics
info

Protecting Against Malicious Use of Remote Monitoring and Management Software

2023-01-26T12:00:00
ics
info

ESXiArgs Ransomware Virtual Machine Recovery Guidance

2023-02-08T12:00:00
ics
info

Weak Security Controls and Practices Routinely Exploited for Initial Access

2022-12-08T12:00:00
ics
info

Tactics, Techniques, and Procedures of Indicted State-Sponsored Russian Cyber Actors Targeting the Energy Sector

2022-03-24T12:00:00
ics
info

Compromise of U.S. Water Treatment Facility

2021-02-12T12:00:00
ics
info

Advanced Persistent Threat Compromise of Government Agencies, Critical Infrastructure, and Private Sector Organizations

2021-04-15T12:00:00
ics
info

Cyber Actors Target K-12 Distance Learning Education to Cause Disruptions and Steal Data

2020-12-10T12:00:00
ics
info

Iranian Advanced Persistent Threat Actor Identified Obtaining Voter Registration Data

2020-11-03T12:00:00
ics
info

North Korean Advanced Persistent Threat Focus: Kimsuky

2020-10-27T12:00:00
ics
info

NSA and CISA Recommend Immediate Actions to Reduce Exposure Across Operational Technologies and Control Systems

2020-10-24T12:00:00
ics
info

Guidance on the North Korean Cyber Threat

2020-06-23T12:00:00
ics
info

DarkSide Ransomware: Best Practices for Preventing Business Disruption from Ransomware Attacks

2021-07-08T12:00:00
ics
info

Control System Defense: Know the Opponent

2022-09-22T12:00:00
ics
info

#StopRansomware: Zeppelin Ransomware

2022-08-11T12:00:00
ics
info

Russian State-Sponsored Cyber Actors Target Cleared Defense Contractor Networks to Obtain Sensitive U.S. Defense Information and Technology

2022-02-16T12:00:00
ics
info

CISA Red Team Shares Key Findings to Improve Monitoring and Hardening of Networks

2023-02-28T12:00:00
ics
info

#StopRansomware: LockBit 3.0

2023-03-16T12:00:00
ics
info

Hunting Russian Intelligence “Snake” Malware

2023-05-09T12:00:00
ics
info

Identification and Disruption of QakBot Infrastructure

2023-08-30T12:00:00
ics
info

ATT&CK Table for Sophisticated Spearphishing Campaign CSA

2021-05-28T12:00:00
ics
info

Technical Approaches to Uncovering and Remediating Malicious Activity

2020-09-24T12:00:00
ics
info

Malicious Cyber Actor Use of Network Tunneling and Spoofing to Obfuscate Geolocation

2020-10-24T12:00:00
ics
info

Microsoft Ending Support for Windows 7 and Windows Server 2008 R2

2019-10-18T12:00:00
ics
info

Update: Destructive Malware Targeting Organizations in Ukraine

2022-04-28T12:00:00
ics
info

2021 Trends Show Increased Globalized Threat of Ransomware

2022-02-10T12:00:00
ics
info

Defending Against Malicious Cyber Activity Originating from Tor

2021-08-02T12:00:00
ics
info

EINSTEIN Data Trends – 30-day Lookback

2020-06-30T12:00:00
ics
info

Chinese Gas Pipeline Intrusion Campaign, 2011 to 2013

2021-07-21T12:00:00
ics
info

Sophisticated Spearphishing Campaign Targets Government Organizations, IGOs, and NGOs

2021-05-29T12:00:00
ics
info

North Korean State-Sponsored Cyber Actors Use Maui Ransomware to Target the Healthcare and Public Health Sector

2022-07-07T12:00:00
ics
info

Top Routinely Exploited Vulnerabilities

2021-08-20T12:00:00
ics
info

People’s Republic of China State-Sponsored Cyber Actors Exploit Network Providers and Devices

2022-06-10T12:00:00
ics
info

Threat Actors Exploit Progress Telerik Vulnerabilities in Multiple U.S. Government IIS Servers

2023-06-15T12:00:00
ics
info

Understanding Ransomware Threat Actors: LockBit

2023-06-14T12:00:00
ics
info

Malicious Actors Exploit CVE-2023-27350 in PaperCut MF and NG

2023-05-11T12:00:00
ics
info

Threat Actors Exploiting F5 BIG-IP CVE-2022-1388

2022-10-12T12:00:00
ics
info

Iranian Government-Sponsored APT Actors Compromise Federal Network, Deploy Crypto Miner, Credential Harvester

2022-11-25T12:00:00
ics
info

Dridex Malware

2020-06-30T12:00:00
ics
info

2021 Top Malware Strains

2022-08-25T12:00:00
ics
info

APT28 Exploits Known Vulnerability to Carry Out Reconnaissance and Deploy Malware on Cisco Routers

2023-04-18T12:00:00
ics
info

Russian State-Sponsored Cyber Actors Gain Network Access by Exploiting Default Multifactor Authentication Protocols and “PrintNightmare” Vulnerability

2022-05-02T12:00:00
ics
info

Publicly Available Tools Seen in Cyber Incidents Worldwide

2020-06-30T12:00:00
ics
info

Critical Vulnerabilities in Microsoft Windows Operating Systems

2020-01-14T12:00:00
ics
info

Karakurt Data Extortion Group

2022-06-02T12:00:00
ics
info

LokiBot Malware

2020-10-24T12:00:00
ics
info

Potential Legacy Risk from Malware Targeting QNAP NAS Devices

2020-08-06T12:00:00
ics
info

Iranian State Actors Conduct Cyber Operations Against the Government of Albania

2022-09-23T12:00:00
ics
info

Preventing Web Application Access Control Abuse

2023-07-27T12:00:00
ics
info

BadAlloc Vulnerability Affecting BlackBerry QNX RTOS

2021-08-23T12:00:00
ics
info

Multiple Nation-State Threat Actors Exploit CVE-2022-47966 and CVE-2022-42475

2023-09-07T12:00:00
ics
info

APT Cyber Tools Targeting ICS/SCADA Devices

2022-05-25T12:00:00
ics
info

APT Actors Exploiting Newly Identified Vulnerability in ManageEngine ADSelfService Plus

2021-11-22T12:00:00
ics
info

Critical Vulnerability in SAP NetWeaver AS Java

2020-07-13T12:00:00
ics
info

APT Actors Exploiting CVE-2021-44077 in Zoho ManageEngine ServiceDesk Plus

2021-12-06T12:00:00
ics
info

Top 10 Routinely Exploited Vulnerabilities

2020-05-12T12:00:00
fireeye
info

This Is Not a Test: APT41 Initiates Global Intrusion Campaign Using Multiple Exploits

2020-03-25T00:00:00
fireeye
info

Putting the Model to Work: Enabling Defenders With Vulnerability Intelligence — Intelligence for Vulnerability Management, Part Four

2020-04-27T12:30:00
attackerkb
info

CVE-2020-8196

2020-07-10T00:00:00
attackerkb
info

CVE-2020-8195

2020-07-10T00:00:00
attackerkb
info

CVE-2020-8193

2020-07-10T00:00:00
attackerkb
info

CVE-2020-15506

2020-07-07T00:00:00
attackerkb
info

CVE-2019-11580

2019-06-03T00:00:00
attackerkb
info

CVE-2019-16278

2019-10-14T00:00:00
attackerkb
info

CVE-2019-16920

2019-09-27T00:00:00
attackerkb
info

Atlassian Crowd: pdkinstall development plugin incorrectly enabled (CVE-2019-11580)

2020-02-13T00:00:00
checkpoint_advisories
info

Citrix ADC Authentication Bypass (CVE-2020-8193; CVE-2020-8195; CVE-2020-8196)

2020-08-03T00:00:00
checkpoint_advisories
info

Atlassian Crowd Remote Code Execution (CVE-2019-11580)

2019-07-16T00:00:00
checkpoint_advisories
info

Nostromo Web Server Directory Traversal (CVE-2019-16278)

2019-12-03T00:00:00
checkpoint_advisories
info

D-Link Routers Remote Code Execution (CVE-2019-16920)

2022-04-19T00:00:00
checkpoint_advisories
info

Progress Telerik UI Remote Code Execution (CVE-2019-18935)

2020-03-09T00:00:00
thn
info

US Agencies and FireEye Were Hacked Using SolarWinds Software Backdoor

2020-12-14T05:44:00
thn
info

CISA: Chinese Hackers Exploiting Unpatched Devices to Target U.S. Agencies

2020-09-15T09:14:00
thn
info

NoxPlayer Supply-Chain Attack is Likely the Work of Gelsemium Hackers

2021-06-14T13:34:00
thn
info

New Exploit Threatens Over 9,000 Hackable Cisco RV320/RV325 Routers Worldwide

2019-01-28T11:31:00
thn
info

U.S. Cybersecurity Agency Lists 2021's Top 15 Most Exploited Software Vulnerabilities

2022-04-28T05:41:00
thn
info

Top 30 Critical Security Vulnerabilities Most Exploited by Hackers

2021-07-29T08:21:00
thn
info

CISA Warning: Nation-State Hackers Exploit Fortinet and Zoho Vulnerabilities

2023-09-08T05:36:00
thn
info

Iranian Hackers Exploiting VPN Flaws to Backdoor Organizations Worldwide

2020-02-18T15:06:00
thn
info

Unmasking XE Group: Experts Reveal Identity of Suspected Cybercrime Kingpin

2023-06-01T14:55:00
exploitdb
exploit

Citrix ADC NetScaler - Local File Inclusion (Metasploit)

2020-11-13T00:00:00
exploitdb
exploit

Cisco RV320 and RV325 - Unauthenticated Remote Code Execution (Metasploit)

2019-04-03T00:00:00
packetstorm
exploit

Citrix ADC NetScaler Local File Inclusion

2020-11-13T00:00:00
packetstorm
exploit

Cisco RV320 / RV325 Unauthenticated Remote Code Execution

2019-03-30T00:00:00
packetstorm
exploit

Nostromo 1.9.6 Directory Traversal / Remote Command Execution

2019-10-31T00:00:00
githubexploit
exploit

Exploit for Missing Authorization in Citrix Application Delivery Controller Firmware

2020-07-12T13:37:53
githubexploit
exploit

Exploit for Missing Authorization in Citrix Application Delivery Controller Firmware

2020-07-13T10:36:43
githubexploit
exploit

Exploit for Path Traversal in Pulsesecure Pulse Connect Secure

2020-04-16T16:32:47
githubexploit
exploit

Exploit for OS Command Injection in Dlink Dir-655 Firmware

2019-10-15T17:54:03
githubexploit
exploit

Exploit for Path Traversal in Nazgul Nostromo Nhttpd

2021-07-19T00:45:07
githubexploit
exploit

Exploit for Path Traversal in Nazgul Nostromo Nhttpd

2020-03-30T08:54:06
githubexploit
exploit

Exploit for Path Traversal in Nazgul Nostromo Nhttpd

2019-11-22T18:35:14
githubexploit
exploit

Exploit for Path Traversal in Nazgul Nostromo Nhttpd

2019-12-31T16:06:13
githubexploit
exploit

Exploit for Path Traversal in Nazgul Nostromo Nhttpd

2019-10-23T22:24:18
githubexploit
exploit

Exploit for Deserialization of Untrusted Data in Telerik Ui For Asp.Net Ajax

2020-08-26T20:57:11
githubexploit
exploit

Exploit for Path Traversal in Nazgul Nostromo Nhttpd

2019-10-15T12:47:59
githubexploit
exploit

Exploit for Path Traversal in Nazgul Nostromo Nhttpd

2019-11-26T14:15:44
zdt
exploit

Citrix ADC NetScaler Local File Inclusion Exploit

2020-11-14T00:00:00
zdt
exploit

Cisco RV320 / RV325 Unauthenticated Remote Code Execution Exploit

2019-03-30T00:00:00
zdt
exploit

nostromo 1.9.6 - Remote Code Execution Exploit

2020-01-01T00:00:00
zdt
exploit

Telerik UI - Remote Code Execution via Insecure Deserialization Exploit

2019-12-18T00:00:00
mssecure
blog

Ransomware groups continue to target healthcare, critical services; here’s how to reduce risk

2020-04-28T16:00:49
mssecure
blog

Securing IoT devices against attacks that target critical infrastructure

2022-10-21T16:00:00
kitploit
tools

ShonyDanza - A Customizable, Easy-To-Navigate Tool For Researching, Pen Testing, And Defending With The Power Of Shodan

2021-12-01T20:30:00
kitploit
tools

ShonyDanza - A Customizable, Easy-To-Navigate Tool For Researching, Pen Testing, And Defending With The Power Of Shodan

2021-12-27T20:30:00
openvas
scanner

Symantec Messaging Gateway Multiple Vulnerabilities Aug17

2017-08-14T00:00:00
nessus
scanner

Symantec Messaging Gateway 10.x < 10.6.3-267 Multiple Vulnerabilities (SYM17-006)

2017-08-16T00:00:00
nessus
scanner

Citrix SD-WAN WANOP 10.2.x Multiple Vulnerabilities (CTX276688)

2020-09-02T00:00:00
nessus
scanner

Cisco Small Business RV320 and RV325 Routers Multiple Vulnerabilities (cisco-sa-20190123-rv-inject, cisco-sa-20190123-rv-info)

2019-04-15T00:00:00
nessus
scanner

Cisco RV320 < 1.4.2.22 Multiple Vulnerabilities

2019-04-16T00:00:00
nessus
scanner

Cisco Small Business RV320 and RV325 Routers Information Disclosure Vulnerability (cisco-sa-20190123-rv-info) (remote check)

2019-01-25T00:00:00
nessus
scanner

Cisco RV325 < 1.4.2.22 Multiple Vulnerabilities

2019-04-16T00:00:00
nessus
scanner

Atlassian Crowd 2.1.x < 3.0.5 / 3.1.x < 3.1.6 / 3.2.x < 3.2.8 / 3.3.x < 3.3.5 / 3.4.x < 3.4.4 RCE Vulnerability

2019-05-28T00:00:00
nessus
scanner

Nostromo < 1.9.7 Remote Code Execution

2020-10-30T00:00:00
nessus
scanner

D-Link Routers Unauthenticated RCE (CVE-2019-16920)

2022-11-03T00:00:00
symantec
software

Symantec Messaging Gateway RCE and CSRF

2017-08-10T08:00:00
metasploit
exploit

Cisco RV320 and RV325 Unauthenticated Remote Code Execution

2019-02-25T14:51:05
metasploit
exploit

Nostromo Directory Traversal Remote Command Execution

2019-10-21T16:11:44
talosblog
blog

Threat Source newsletter (Jan. 16, 2019)

2020-01-23T07:27:43
securelist
blog

Incident Response Analyst Report 2019

2020-08-06T10:00:34
pentestpartners
blog

CVE-2020-1472/Zerologon. As an IT manager should I worry?

2020-09-23T05:05:06
impervablog
blog

Australian Cyber Attack Vectors Blocked Out of the Box by Imperva WAF

2020-07-06T15:01:00
rapid7blog
info

Metasploit Wrap-Up

2020-10-09T19:41:47
cve
NVD

CVE-2019-11580

2019-06-03T14:29:00
cve
NVD

CVE-2019-16278

2019-10-14T17:15:00
cve
NVD

CVE-2019-16920

2019-09-27T12:15:00
cisa
info

EOL D-Link Routers Vulnerable to Remote Command Execution

2019-10-24T00:00:00
cisa_kev
info

Citrix ADC, Gateway, and SD-WAN WANOP Appliance Authorization Bypass Vulnerability

2021-11-03T00:00:00
atlassian
software

Crowd - pdkinstall development plugin incorrectly enabled - CVE-2019-11580

2019-05-06T04:06:13
cert
info

Multiple D-Link routers vulnerable to remote command execution

2019-10-23T00:00:00
exploitpack
exploit

nostromo 1.9.6 - Remote Code Execution

2020-01-01T00:00:00