Japan-Linked Organizations Targeted in Long-Running and Sophisticated Attack Campaign

guest · Nov 18, 2020

Symantec implicates APT10 in sweeping hacking campaign against Japanese firms
Novembe r17, 2020
https://www.cyberscoop.com/apt10-china-japan-intellectual-property-symantec/

A Chinese government-linked hacking group whose operatives have been indicted by the U.S. and sanctioned by the European Union is suspected in a year-long effort to steal sensitive data from numerous Japanese companies and their subsidiaries, security researchers said Tuesday.

The attackers, known as APT10 or Cicada, have been burrowing into the networks of companies in the automotive, pharmaceutical and engineering sectors, according to researchers from antivirus provider Symantec. They have sometimes lingered for months before trying to extract data and have targeted domain controllers, the servers that act as gatekeepers for organizations’ network traffic.
While Symantec did not identify specific targets, the company said many of the organizations have links to Japan, or Japanese companies.

“We believe the APT10/Cicada campaign is focused on large-scale IP [intellectual property] theft across multiple verticals,” said Vikram Thakur, technical director at Symantec, a division of semiconductor maker Broadcom.
Click to expand...

The Symantec research follows multiple high-profile cybersecurity incidents in Japan this year.
Unidentified attackers in May breached Japanese data-management company NTT Communications in an incident affected up to 621 clients. Separately, Japanese officials have been investigating a possible breach of sensitive defense contracting data following a 2019 attack on electronics giant Mitsubishi Electric.

There is no evidence connecting APT10 to those incidents, Thakur said.
Click to expand...

Symantec: Japan-Linked Organizations Targeted in Long-Running and Sophisticated Attack Campaign

Evidence that advanced persistent threat group Cicada is behind attack campaign targeting companies in 17 regions and multiple sectors.
Cicada has historically been known to target Japan-linked organizations, and has also targeted MSPs in the past.
The attackers extensively use DLL side-loading in this campaign, and were also seen leveraging the ZeroLogon vulnerability that was patched in August 2020.
Click to expand...

Log in or Sign up

Japan-Linked Organizations Targeted in Long-Running and Sophisticated Attack Campaign

guest Guest

Log in or Sign up

Japan-Linked Organizations Targeted in Long-Running and Sophisticated Attack Campaign

guest Guest

Useful Searches