Hackers hit over a dozen mobile carriers and could shut down networks, researchers find

guest · Jun 25, 2019

Hackers hit over a dozen mobile carriers and could shut down networks, researchers find
June 24, 2019
https://www.cnet.com/news/hackers-h...nd-could-shut-down-networks-researchers-find/

Hackers have quietly infiltrated more than a dozen mobile carriers around the world, gaining complete control of networks behind the companies' backs. The attackers have been using it over the last seven years to steal sensitive data, but have so much control, they could shut down communications at a moment's notice, according to Cybereason, a security company based in Boston.

Security researchers from the company on Tuesday said they've been investigating the campaign it's named Operation Softcell [...]
It marks a potentially massive breach -- with more fallout still to come -- as companies across different industries struggle with how to protect their customers' data. The hackers also had high-privileged access to do more than steal information.

Serper said he didn't find any US mobile carriers that were affected, but the hacking campaign is ongoing and it's possible that could change.
While the hackers had access to millions of people's data, they had only stolen data from less than 100 highly targeted victims.
Click to expand...

How the attacks happened
Cybereason's researchers found that the attackers gained access to more than a dozen mobile carriers by exploiting old vulnerabilities, like malware hidden in a Microsoft Word file or finding an exposed public server belonging to the company. [...]

Because the attack method was this sophisticated and targeted, Cybereason researchers believe the hackers were backed by a nation-state.
Click to expand...

Cybereason: Operation Soft Cell: A Worldwide Campaign Against Telecommunications Providers

We’ve concluded with a high level of certainty that the threat actor is affiliated with China and is likely state sponsored. The tools and techniques used throughout these attacks are consistent with several Chinese threat actors, specifically with APT10, a threat actor believed to operate on behalf of the Chinese Ministry of State Security (MSS).

The attack began with a web shell running on a vulnerable, publicly-facing server, from which the attackers gathered information about the network and propagated across the network. The threat actor attempted to compromise critical assets, such as database servers, billing servers, and the active directory. As malicious activity was detected and remediated against, the threat actor stopped the attack.
Click to expand...

guest · Jun 25, 2019

Telcos Pwned: Multi-Wave Attacks Stealing 'Obscene Amount of Data' From Providers
June 25, 2019
https://www.securityweek.com/telcos-pwned-multi-wave-attacks-stealing-obscene-amount-data-providers

"What we're talking about," Amit Serper, head of security research at Nocturnus, told SecurityWeek, "is a global campaign against mobile telecoms companies. The attackers are hacking into the service providers, completely controlling the network, and exfiltrating an obscene amount of data out of them. We're talking about gigabytes of data."

"This information is only relevant to an intelligence service. This is an intelligence gathering operation by a foreign nation. So far, everything points very strongly back to China."
Overall, hundreds of gigabytes have been downloaded, but always in relatively smaller amounts to avoid egress detection.
Click to expand...

A modified version of Nbtscan was used to identify available NetBIOS name servers locally or over the network, while multiple Windows built-in tools were used for various tasks, including whoami, net.exe, ipconfig, netstat, portqry, and more

The threat actor made sure that each payload has a unique hash, and some payloads were packed using different types of packers, both known and custom.
The Poison Ivy RAT, commonly associated with Chinese state actors, was used to maintain access across the compromised assets.

A modified version of Mimikatz was used to dump credentials, while WMI and PsExec were employed for lateral movement. Winrar was used to compress and password-protect stolen data, and a modified version of hTran was used to exfiltrate the data.
The attackers are now so deeply embedded in their victims' systems that they effectively own the networks.
Click to expand...

Log in or Sign up

Hackers hit over a dozen mobile carriers and could shut down networks, researchers find

guest Guest

guest Guest

Log in or Sign up

Hackers hit over a dozen mobile carriers and could shut down networks, researchers find

guest Guest

guest Guest

Useful Searches