Chinese APTs have been targeting Linux servers for almost a decade

guest · Apr 7, 2020

Chinese APTs have been targeting Linux servers for almost a decade
April 7, 2020
https://betanews.com/2020/04/07/chinese-apts-target-linux/

Five related Advanced Persistent Threat (APT) groups operating in the interest of the Chinese government have systematically targeted Linux servers, Windows systems and mobile devices running Android while remaining undetected for nearly a decade.

A new report from BlackBerry looks at how these threats have been part of pervasive economic espionage operations targeting intellectual property.
The BlackBerry report examines how APTs have leveraged the 'always on, always available' nature of Linux servers to establish a 'beachhead for operations' across a wide range of targets.

"Linux is not typically user-facing, and most security companies focus their engineering and marketing attention on products designed for the front office instead of the server rack, so coverage for Linux is sparse," says Eric Cornelius, chief product architect at BlackBerry.
"These APT groups have zeroed in on that gap in security [...]"
Click to expand...

The report concludes that the APT groups examined in this report are likely comprised of civilian contractors working in the interest of the Chinese state who readily share tools, techniques, infrastructure, and targeting information with one another and their government counterparts.

"This report opens another chapter in the Chinese IP theft story, providing us with new lessons to learn."
Click to expand...

Blackberry: Report: Decade of the RATs
(PDF - 4.80 MB): https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-bb-decade-of-the-rats.pdf

Novel Cross-Platform APT Attacks Targeting Linux, Windows and Android
Click to expand...

ZDNet: These hackers have been quietly targeting Linux servers for years

These hacking groups have zeroed in on that gap in security and leveraged it for their strategic advantage to steal intellectual property from targeted sectors for years without anyone noticing, he said.

"It's critical for these servers to be up all the time; so what better place to put a root kit or a pervasive active tool than on a machine that's going to be turned on all time?," said Cornelius.
The attackers scan for Red Hat Enterprise, CentOS, and Ubuntu Linux environments across a wide range of industries, attempting to identify unpatched servers. From there it's simply a case of establishing persistence on the network with malware.

"These types of compromises are only prevented by good cyber hygiene, there's no magic that can be done, there's no silver bullet that an organisation can use to suddenly not be compromised," said Cornelius.
Click to expand...

"What this shows that in order to be secure against these adversaries, you have to be secure across all fronts; Windows, mobile, Linux and Macs," he said.
Click to expand...

guest · Apr 8, 2020

Who is World Wired Labs and why are they selling an Android trojan?
April 7, 2020
https://www.cyberscoop.com/world-wired-labs-winnti-netwire-china-blackberry-cylance/

A company advertising a remote access tool frequently used by criminals and nation-state hackers may be serving as a front for a Chinese hacking group, according to new research published Tuesday by BlackBerry Cylance.

In a lengthy report on remote access trojans (RAT), BlackBerry Cylance researchers detail an Android malware variant, which they call PWNDROID4, that can be used to monitor targets’ phone calls, record audio, send and receive text messages, and track victims’ GPS location. Researchers believe it has been used by suspected Chinese government-linked hackers known as the Winnti group.
In the report, researchers have pieced together that PWNDROID4 is remarkably similar to the Android version of a RAT known as NetWire, which has been around since 2017.

Cornelius said World Wired Labs could possibly be used for cover by Winnti to hide the fact that the group is responsible for the tool’s development.
Click to expand...

Although the Cylance researchers did not name victims, the Linux targeting appears to have been used alongside the Windows targeting, according to Cornelius.

The majority of the Linux samples BlackBerry Cylance researchers found had a zero detection rate in industry virus repositories, suggesting this activity has maintained access to targets for some time, largely undetected, according to BlackBerry Cylance.
Click to expand...

Rasheed187 · Feb 19, 2022

mood said: ↑

Chinese APTs have been targeting Linux servers for almost a decade
April 7, 2020
https://betanews.com/2020/04/07/chinese-apts-target-linux/

Blackberry: Report: Decade of the RATs
(PDF - 4.80 MB): https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-bb-decade-of-the-rats.pdf

ZDNet: These hackers have been quietly targeting Linux servers for years
Click to expand...

Sorry about this Mood, didn't know you already posted this topic nearly 2 years ago.

I always wondered about how hackers managed to steal data from companies, and turns out these attacks are way more advanced than I thought. And it also shows that Linux should be monitored in the same way as Windows, because this malware is quite stealthy.

Log in or Sign up

Chinese APTs have been targeting Linux servers for almost a decade

guest Guest

guest Guest

Rasheed187 Registered Member

Log in or Sign up

Chinese APTs have been targeting Linux servers for almost a decade

guest Guest

guest Guest

Rasheed187 Registered Member

Useful Searches