26 C
Jaipur
Monday, October 26, 2020

APT 41 Hackers Launching Cyber Attack Using Cisco, Citrix, Zoho Exploits

Must read

IIT-H researcher develops nanofibrous bags for seed storage – Latest News

A researcher from the Indian Institute of Technology, Hyderabad (IIT-H) has developed encapsulated electrospun polyurethane (PU) nanofibrous bags to prevent seed storage losses. Professor Chandra...

7 Free Horror Movie Websites For Legal Streaming In 2020

Horror movies tend to engage the audience in a manner that other movie genres don’t. They scare the audience, raise their goosebumps, and can...

Qualcomm: Qualcomm partners with audio firm for hearing enhancement software

Qualcomm Technologies International has collaborated with Jacoti, an audio technology company, to bring Jacoti’s hearing enhancement software to the...

Smartphones: Motorists with smartphones could help highway chiefs maintain road quality: Study – Latest News

Motorists with smartphones could help highway chiefs maintain road quality by sending "crowdsourced" data from their mobiles that would allow engineers to assess when...

APT 41, Chinese hackers groups launched a massive cyberattack on dozens of countries around the globe using exploits that trigger the vulnerabilities in Cisco, Citrix, Zoho products.

Several countries are being targeted including Australia, Canada, Denmark, Finland, France, India, Italy, Japan, Malaysia, Mexico, Philippines, Poland, Qatar, Saudi Arabia, Singapore, Sweden, Switzerland, UAE, UK, and USA.

There are 3 main products are being exploited in this attack, that are Citrix Application Delivery Controller, Cisco routers and Zoho ManageEngine Desktop Central. 

Attacker targeting several governments and private sectors including Healthcare, High Technology, Higher Education, Legal, Manufacturing, Media, Non-profit, Oil & Gas, Petrochemical, Pharmaceutical, Real Estate, Telecommunications, Transportation, Travel, and Utility.

Researchers from FireEye observed that the attack has been performed between January 20 and March 11.

Vulnerability Exploitation Details

This attack has been initially observed when threat actors attempted to exploit Citrix Application Delivery Controller (ADC) vulnerability CVE-2019-19781 on January 20, 2020. 

The exploitation attempt was involved execution of the command ‘file /bin/pwd’ that helps them to identify the vulnerable and patched system in the victim’s network.

In February, APT 41 actors start downloading the unknown payload from File Transfer Protocol (FTP) and the payload named “bsd” that looked like a backdoor.

According to the FireEye report “We observed a significant uptick in CVE-2019-19781 exploitation on February 24 and February 25. The exploit behavior was almost identical to the activity on February 1, where only the name of the payload ‘un’ changed.”

Exploiting Cisco Router

The researcher observed another successful exploitation attempt on Cisco RV320 routers that were deployed in telecommunications networks on Feb 21, 2020.

“It is unknown what specific exploit was used, but there is a Metasploit module that combines two CVE’s (CVE-2019-1653 and CVE-2019-1652) to enable remote code execution on Cisco RV320 and RV325 small business routers and uses wget to download the specified payload,” FireEye said.

APT 41

Exploiting Zoho ManageEngine Zero-Day Bug

APT actors another attack was targeted the several organizations that deployed Zoho ManageEngine Desktop Central versions before 10.0.474 (CVE-2020-10189) that contained a zero-day remote code execution vulnerability.

FireEye observed that APT41 use 91.208.184[.]78 to attempt to exploit the Zoho ManageEngine vulnerability at more than a dozen FireEye customers and five customers were reportedly compromised during the attempt.

APT 41 Attackers directly upload “logger.zip”, a simple Java-based program, which contained a set of commands to use PowerShell to download and execute install.bat and storesyncsvc.dll.

Also, the attackers leverage the Microsoft BITSAdmin command-line tool to download install.bat  that helps them to install persistence for a trial version of the Cobalt Strike BEACON loader.

The researcher believes that the BEACON shellcode that downloaded from the C2 server may be used to attempting to diversify post-exploitation access to the compromised systems.

Source link

- Advertisement -

More articles

LEAVE A REPLY

Please enter your comment!
Please enter your name here

Latest article

IIT-H researcher develops nanofibrous bags for seed storage – Latest News

A researcher from the Indian Institute of Technology, Hyderabad (IIT-H) has developed encapsulated electrospun polyurethane (PU) nanofibrous bags to prevent seed storage losses. Professor Chandra...

7 Free Horror Movie Websites For Legal Streaming In 2020

Horror movies tend to engage the audience in a manner that other movie genres don’t. They scare the audience, raise their goosebumps, and can...

Qualcomm: Qualcomm partners with audio firm for hearing enhancement software

Qualcomm Technologies International has collaborated with Jacoti, an audio technology company, to bring Jacoti’s hearing enhancement software to the...

Smartphones: Motorists with smartphones could help highway chiefs maintain road quality: Study – Latest News

Motorists with smartphones could help highway chiefs maintain road quality by sending "crowdsourced" data from their mobiles that would allow engineers to assess when...

taipa: TAIPA calls for implementation of network roll out rules notified 3 years ago – Latest News

Telecom infrastructure industry body TAIPA on Monday reiterated its demand to implement network roll out rules, notified three years ago, in all states to...