FBI: Nation-state actors have breached two US municipalities

guest · Jan 16, 2020

FBI: Nation-state actors have breached two US municipalities
The SharePoint CVE-2019-0604 vulnerability has been one of the most targeted security flaw
January 16, 2020
https://www.zdnet.com/article/fbi-nation-state-actors-have-breached-two-us-municipalities/

Nation-state hackers have breached the networks of two US municipalities last year, the FBI said in a security alert sent to private industry partners last week.

The hacks took place after attackers used the CVE-2019-0604 vulnerability in Microsoft SharePoint servers to breach the two municiplities' networks.

"Due to the sophistication of the compromise and Tactics, Techniques, and Procedures (TTPs) utilized, the FBI believes unidentified nation-state actors are involved in the compromise," the agency said in its security alert.
The FBI could not say if both intrusions were carried out by the same group. The agency also did not name the two hacked municipalities; however, it reported the two breaches in greater detail, listing the attackers' steps in each incident.
Click to expand...

MUNICIPALITY #1:
An unpatched SharePoint server was utilized to gain access to a US municipality's network, steal the Active Directory (AD) database, compromise administrative credentials, and drop webshells for remote/backdoor access to the compromised servers.
[...] The intrusion appears to have been detected while the actors were still in the reconnaissance phase of the intrusion, so their actual objectives on target could not be determined.
MUNICIPALITY #2:
In October 2019, a second US municipality's network was targeted by unauthorized users. Intrusion activity was detected when Command and Control (C2) communications were discovered from the DMZ network segment.
CHINESE NATION-STATE HACKERS HAVE PREVIOUSLY EXPLOITED THIS BUG
The attacks on US municipalities are not isolated cases, nor are they the first attacks where the CVE-2019-0604 SharePoint vulnerability has been used.

Neither agency named the perpetrators of these attacks, but US cyber-security firm Palo Alto Networks linked the two reports to APT27 (Emissary Panda), a hacking group with ties to the Chinese government.
Click to expand...

The bug is a so-called pre-auth RCE (pre-authentication remote code execution). Pre-auth RCEs are extremely attractive to attackers as they are easy to automate and exploit.
Click to expand...

Log in or Sign up

FBI: Nation-state actors have breached two US municipalities

guest Guest

Log in or Sign up

FBI: Nation-state actors have breached two US municipalities

guest Guest

Useful Searches