chinese espionage group deploys new compatible

#CHINESE ESPIONAGE GROUP DEPLOYS NEW COMPATIBLE SOFTWARE#
#CHINESE ESPIONAGE GROUP DEPLOYS NEW COMPATIBLE WINDOWS#

In the past the group broke into networks by using email spear phishing with malicious links and attachments, used stolen VPN and other remote access credentials, bypassed multi-factor authentication and exploited vulnerabilities in common enterprise software and appliances such as CVE-2019-19781 for Citrix, CVE-2019-11510 for Pulse Secure VPNs, CVE-2018-13379 for FortiGate VPNs, and CVE-2019-9670 in Zimbra software and CVE-2020-0688 in Microsoft Exchange Control Panel.įoggyWeb is a passive backdoor, meaning it does not actively reach out to a command-and-control server, an activity that could be flagged as suspicious by a firewall. APT29 is known to use multiple network intrusion tactics and compromising the software supply-chain like in the SolarWinds case is just one of them. Installing FoggyWeb requires administrative credentials, which is why the malware is deployed only after attackers have already gained access to the network and engaged in lateral movement to obtain admin credentials.

#CHINESE ESPIONAGE GROUP DEPLOYS NEW COMPATIBLE WINDOWS#

The backdoor uses some advanced deployment techniques that highlight its creators’ deep knowledge of AD FS, Windows services and APIs. What is FoggyWeb and how does it work?įoggyWeb is a post-exploitation backdoor with a focus on persistence and data exfiltration that was built specifically to interact with AD FS servers. The group is considered the hacking arm of Russia’s foreign intelligence service, the SVR and is known for its high level of sophistication and stealth. This same group was behind the SolarWinds supply chain compromise last year that resulted in corporate networks being compromised through Trojanized software updates. In a new report, Microsoft attributes the malware program called FoggyWeb to a group the company tracks as NOBELIUM, but which is also known in the security industry as APT29 or Cozy Bear. This article by Dr Will Stoltz first appeared in The Australian on.Security researchers have recently seen a notorious cyberespionage group with ties to the Russian government deploy a new backdoor that’s designed to hook into Active Directory Federation Services (AD FS) and steal configuration databases and security token certificates. Some reading the word ‘ASIS’ may assume a spelling error of ‘ASIO’ – the acronym for Australia’s much better-known domestic security service. Such is the invisibility of our foreign spy agency in the historical and cultural consciousness of Australians. But in considering how we are to find peace in the face of hostility from China and Russia, Australians will need to look anew at the work of their secret service, which includes foreign espionage and covert action.ĪSIS’s obscurity is partially due to the efforts of successive governments to keep hidden its highly classified operations, including discouraging media reporting on the agency. Despite being created in 1952 ASIS was not officially revealed until 1977.ĪSIS has only rarely featured publicly, and typically in relation to several historic scandals. These include accusations of supporting a CIA-backed coup in Chile in 1973 a botched armed exercise at a Melbourne hotel in 1983 and an alleged operation in the 2000s to listen-in on the Timor Leste cabinet during gas treaty negotiations. These scandals aside, there are no significant cultural portrayals to give Australians a sense of the work and history of ASIS. As a result Australians can be forgiven for having a degree of incuriousness about ‘the Service’. There are, after all, no Australian James Bonds, George Smileys, or Jack Ryans to drive the myth-making around Australia’s overseas spies. Yet, as ASIS marks its 70th birthday, there is a need for Australians to better understand its work.

Chinese espionage group deploys new compatible