DarkHotel APT uses VPN zero-day in attacks on Chinese government agencies

guest · Apr 6, 2020

DarkHotel APT uses VPN zero-day in attacks on Chinese government agencies
April 6, 2020
https://securityaffairs.co/wordpress/101151/apt/darkhotel-hit-china.html

Chinese security-firm Qihoo 360 has uncovered a hacking campaign conducted by a DarkHotel APT group (APT-C-06) aimed at Chinese government agencies in Beijing and Shanghai. State-sponsored hackers used a zero-day vulnerability in Sangfor SSL VPN servers to gain access to victims’ networks.

Since March, more than 200 VPN servers have been compromised by hackers, including 174 systems belonging to Chinese institutions abroad.

“Recently, Qihoo 360 captured malicious samples issued through hijacked security services of a domestic VPN vendor SangFor. The targeted attack was initiated by Darkhotel (APT-C-06), a Peninsula APT Group, targeting Chinese institutions abroad and relevant government units. Up to now, a large number of VPN users have been attacked.” reads the analysis published by Qihoo 360. “When users of the victim agency used VPN clients, the update process triggered by default was hijacked by the hackers. The update program was replaced and embedded with a backdoor.”
Once the attackers have breached the target Sangfor VPN server exploiting a zero-day vulnerability, they replaced the SangforUD.exe program with a backdoored version that is hard to distinguish.
The SangforUD.exe executable is an update for the Sangfor VPN desktop app.
Click to expand...

According to Qihoo360 the attacks are very sophisticated and concealed.
Sangfor plans to release a security patched within tomorrow.
Click to expand...

Qihoo 360: The DarkHotel (APT-C-06) Attacked Chinese Institutions Abroad via Exploiting SangFor VPN Vulnerability

Recently, Qihoo 360 detected an APT attack that deliver malicious files through hijacked security services of a domestic VPN provider. We have reported the vulnerability details to the service provider and received confirmation.

Report from Qihoo 360 indicates the attacker has completely controlled the VPN server of the above-mentioned agencies, and replaced the key update program on the VPN server with a backdoor program. When VPN users log in successfully, their devices will be fully trusted. Therefore, it can be said that the attacker a large number of endpoint devices have been under the control of the attackers.
Click to expand...

guest · Apr 6, 2020

A Chinese security firm says DarkHotel hackers are behind an espionage campaign, but researchers want more details
April 6, 2020
https://www.cyberscoop.com/dark-hotel-qihoo-360-covid-19/

A well-resourced hacking group with possible ties to South Korea has launched an apparent espionage campaign against the Chinese government as international governments grapple with the COVID-19 pandemic, according to a Chinese security firm.
The timing of the attack coincides with instructions from the Chinese government forcing citizens to work from home in order to mitigate COVID-19’s spread.

Outside security researchers with experience chasing nation-state hacking groups immediately questioned whether Qihoo 360 could be sure that the DarkHotel group could be behind the campaign.

“I’m going to be a bit blunt here,” tweeted Brian Bartholomew, a researcher from Kaspersky Lab, which tracks DarkHotel. “This write up is full of speculation, no evidence this was actually [DarkHotel], and a ton of confirmation bias about targeting because of COVID. Not saying they’re wrong, but in the future, there needs to be more supporting data to support claims.”
Click to expand...

VPN services are meant to provide remote workers with an additional layer of security when they’re working outside the office, a level of trust that Qihoo says hackers have used against their victims since at least March.
“If the VPN server is compromised at this moment, the consequences will be unimaginable,” the company said in its report Monday.
Click to expand...

Log in or Sign up

DarkHotel APT uses VPN zero-day in attacks on Chinese government agencies

guest Guest

guest Guest

Log in or Sign up

DarkHotel APT uses VPN zero-day in attacks on Chinese government agencies

guest Guest

guest Guest

Useful Searches