Chinese Hackers

[kyonides]

Double-dipping scammers don't need malware
to grab card numbers and turn a profit

https://www.cyberscoop.com/china-based-e...-advisory/
Directly stealing your credit card number might no longer be the only way hackers can rob you.

A China-based e-commerce scam appears to be harvesting payment information not through direct hacks on companies or using pernicious malware to skim data, but with a simpler approach. The fraudsters set up hundreds of websites that appear to sell legitimate goods, but instead capture card numbers for sale on the dark web.
In addition to vending the card data and other information about shoppers in cybercriminal forums, they also collect money for items that are faulty, counterfeit, or nonexistent.
Tens of thousands of payment records from the U.S. and elsewhere have been exposed.

You know, it's weird to see how easily they can grab your money. There gotta be an explanation on how they successfully hide their funds, right?

An operation like this takes some infrastructure, of course. To appear as legitimate merchants while hiding their connections to the larger scam, each of the sites needs a unique merchant name and merchant identification number (MID). Getting an MID “requires either a direct partnership with an acquiring bank or a relationship with a third-party merchant company that works with a dedicated acquiring bank,” Gemini notes, adding that “nearly 200 of the scam sites from the identified group were linked to the Chinese acquiring bank Jilin Jiutai Rural Commercial Bank Co., Ltd.”

But that's not the only way they can pretend to be legitimate businesses.
 

Gemini says there are about 600 associated web addresses, and most of them are registered through China’s ename.net. The fake stores generally use the e-commerce platform OpenCart, because it’s open source — as opposed to a platform like Shopify, which has fraud monitoring and mitigation policies in place. The group also relies on web infrastructure from Cloudflare to hide its IP addresses for all of its sites.

So visiting those sites means they can flood them with malware and you wouldn't notice it in time. Even so they have another method to trick you in no time if you're weak and can be easily tempted by a good offer.

The sites use Google Ads and social media advertisement campaigns to attract customers with offers for products at a discount below market deals. The sites’ advertisements almost always indicate that the deals are part of a limited-time sale to pressure potential customers into making a purchase.

[kyonides]

Suspected Chinese hackers impersonate Catholic news outlets

to gather intel about Vatican diplomacy

https://www.cyberscoop.com/chinese-hacki...h-vatican/
I had warned you about Chinese hackers known as Mustang Panda or RedDelta working for the CCP that had infiltrated the Vatican's network and read their emails back in July. Two weeks later they had resumed those pesky activities. Things are different now, they went after their news outlets. And they attempted to avoid detection by using a programing language created by Google, namely Go alias Golang.

The latest spate of targeting has included spoofed email headers meant to imitate journalists from the Union of Catholic Asia News and lures about the provisional agreement between the Vatican Holy See and the Chinese Communist Party.
The hackers have also been targeting unidentified entities in Hong Kong and Australia, in addition to government entities in India and Indonesia, in recent months as well

Sadly, the company behind this revelation can't tell us how exactly they managed to get access to such outlets. They suspect they might have relied on PlugX malware.

[kyonides]

China exploiting mobile networks to spy on American cellphones

Signaling messages help networks connect calls and track roaming behind the scenes

China may be abusing telecoms' vulnerabilities to spy on Americans’ cellphones through Caribbean phone networks, according to a new report.
“No one in the industry wants the public to know the severity of ongoing surveillance attacks,” Gary Miller, a former tech security executive, told the Guardian in a new report published Tuesday. “I want the public to know about it.”
Miller based his findings on years spent examining threat reports and signaling traffic between foreign and domestic mobile operators. He told the paper that China may have used Caribbean networks to do the job – Barbados, in particular.

Sadly, China has infiltrated Latin American telecommunications one way or another. Huawei provides a large Brazillian telecom with towers and cellphones. I can't guarantee they're not spying on people there.

[kyonides]

2021 seemed to be boring but guess what? I was totally wrong!
China is still looking for ways to fool people and steal their money or data!

India Arrests 2 Chinese Women for Circulating Infected App on WhatsApp

Part One

India arrested two Chinese women and ten others accused of operating a racket in New Delhi that duped 40,000 people through an infected app circulated on WhatsApp. This is the most recent incident of cybercrime involving Chinese apps, some of which may be linked to Chinese espionage.
The infected app helped the accused capture the personal data of unsuspecting people for illegitimate purposes. It lured people by offering them lucrative returns on an online multilevel marketing campaign. The cybercriminals allegedly offered the victims $41 (3000 rupees) of daily commission for spending 30 minutes on the app called NewWorld for promoting internet celebrities on Facebook, Instagram, and Youtube.
Once the unsuspecting users downloaded it, the apps installed malware that took control of the users’ social media accounts.

But how exactly did they fool the Indian customers!?

The Deputy Commissioner of Police (DCP) Cybercrime of Delhi Police said on Jan. 15 that the malicious app hacked into “Indian users’ devices and also pushed them to follow Social Media (FB, Insta & YT) accounts of unknown origin and control.”
Once the users downloaded the app, the network sent them social media videos to like and social media accounts to follow and for every such action, the users were paid 8 cents (6 rupees), according to India Times.
If the users opted for a VIP membership, the number of tasks assigned and the amount paid for every activity exponentially increased. The users were made to pay $14 to $684 (1000 rupees to 50,000 rupees) for obtaining the VIP status.
“The malicious App also induced users to pay for VIP accounts to earn more. These payments were never honored and were siphoned off,” said the DCP Cybercrime in a message on Twitter.
The police froze $819,000 (6 crores) from several bank accounts and also recovered $34,125 (25 lakhs) from the arrested Chinese nationals.
“They used more than 40 shell companies and a large number of Bank accounts, Crypto-Wallets, etc., to launder and siphon the cheated money,” said the DCP Cybercrime.

Google pulls off 60 made-in-China instant loan apps from India on police complaint

Part Two

Meanwhile, in another incident of China-linked cybercrime in India, Google removed 60 made-in-China small loan apps from its play store on Friday in response to a complaint by the Hyderabad Police.
All these apps were made-in-China but were uploaded in India, reported The Times of India. Weeks ago the Indian investigating agencies had requested Google to remove 300 apps from its store.
The agencies were investigating how these apps lure and dupe unsuspecting people and harass them for missing repayment deadlines even by a few hours or a day.
Six people in India killed themselves because of being publicly humiliated by such app running operations, reported the Times of India.

Yes, guys, China's extremely barefaced attitude also cost other people's lives.

[kyonides]

New nation-state cyberattacks

Today, we’re sharing information about a state-sponsored threat actor identified by the Microsoft Threat Intelligence Center (MSTIC) that we are calling Hafnium. Hafnium operates from China, and this is the first time we’re discussing its activity. It is a highly skilled and sophisticated actor.
Historically, Hafnium primarily targets entities in the United States for the purpose of exfiltrating information from a number of industry sectors, including infectious disease researchers, law firms, higher education institutions, defense contractors, policy think tanks and NGOs. While Hafnium is based in China, it conducts its operations primarily from leased virtual private servers (VPS) in the United States.
Recently, Hafnium has engaged in a number of attacks using previously unknown exploits targeting on-premises Exchange Server software. To date, Hafnium is the primary actor we’ve seen use these exploits, which are discussed in detail by MSTIC here. The attacks included three steps.

1. It would gain access to an Exchange Server either with stolen passwords or by using the previously undiscovered vulnerabilities to disguise itself as someone who should have access.
   
2. It would create what’s called a web shell to control the compromised server remotely.
   
3. It would use that remote access – run from the U.S.-based private servers – to steal data from an organization’s network.
   

MS also claimed it had published security updates to fix Exchange Server's vulnerabilities. They also added it had nothing to do with the SolarWinds hack I reported months ago.

[kyonides]

Chinese government-backed hackers
infiltrated US pipeline companies, FBI says

State-sponsored Chinese cybercriminals successfully hacked into the control systems of several U.S. oil and natural gas pipelines between December 2011 to 2013, a Wednesday alert from the Department of Homeland Security’s cyber outfit and the FBI reveals.

The spearphishing activity appears to have started in late December 2011. From December 9, 2011, through at least February 29, 2012, ONG organizations received spearphishing emails specifically targeting their employees. The emails were at constructed with a high level of sophistication to convince employees to view malicious files.

In addition to spearphishing, CISA and the FBI were made aware of social engineering attempts by malicious actors believed to be associated with this campaign. The apparent goal was to gain sensitive information from asset owners. One asset owner reported that individuals in their network engineering department, including managers, received multiple phone calls requesting information about their recent network security practices. Other employees in other departments were not targeted. The asset owner also reported that these calls began immediately after they had identified and removed the malicious intruder from their network and performed a system-wide credential reset. The caller identified himself as an employee of a large computer security firm performing a national survey about network cybersecurity practices. He inquired about the organization’s policy and practices for firewall use and settings, types of software used to protect their network, and the use and type of intrusion detection and/or prevention systems. The caller was blocking his caller ID and when the targeted organization tried to return the call, they reached a number that was not in service.

Be careful, guys!
Thieves like our friend here  are always looking for gullible people they can easily fool in order to retrieve as much information as possible. And it always will cost you a lot!

Chinese spies are exploiting routers to try hacking French targets

France’s national cybersecurity agency said on Wednesday that it is contending with a massive campaign by Chinese state-backed hackers targeting French organizations through compromised routers.
The Agence nationale de la sécurité des systèmes d’information (French National Agency for the Security of Information Systems), or ANSSI, released forensic information to help French entities to recognize if they had been compromised. The alert did not specify which industries or specific organizations were targets.
ANSSI said the APT31 group, sometimes known as Zirconium or Judgment Panda, carried out the reconnaissance. The group’s prior targets include Finland’s parliament, according to a June allegation from the Finnish Security and Intelligence Service, and the presidential campaign of then-contender Joe Biden in 2020, according to Google’s Threat Analysis Group.

They claim the hacking campaign is still in progress.

[kyonides]

Suspected Chinese hackers took advantage of
Microsoft Exchange vulnerability to steal call records

Hackers with ties to China took advantage of vulnerabilities in Microsoft Exchange for several months starting in late 2020 to steal call logs from a Southeast Asia telecommunication company, researchers at Cybereason report.

The White House last month formally blamed Chinese government-affiliated hacking group HALFNIUM for a massive hacking campaign exploiting vulnerabilities in Microsoft Exchange servers, a kind of mail technology. Cybereason found that the groups targeting the unnamed Southeast Asian telecom had access to the same vulnerability for months prior to Microsoft’s disclosure.

The new findings build on a 2019 report from Cybereason, in which investigators identified a long-running hacking campaign that breached about 10 cellular providers in Africa, Europe, the Middle East, and Asia. Now researchers can say that not only has that group not let up, but that they are now also joined by two more groups tied to Chinese intelligence conducting the same kinds of operations.

The three clusters of activity detailed in the report had evaded detection since at least 2017, according to the research. Given the focus on the same target and the overlap in tactics, it appears likely that all three groups were working in the interest of the Chinese government, says Assaf Dahan, head of threat research at Cybereason.
...
While the hackers have primarily targeted Asian telecom providers, the attacks could be recreated against providers in other regions, Dahan notes.

If hackers were evil already, being tied to Chinese intelligence makes them deadlier than ever.

[kyonides]

Most advanced China-linked backdoor ever

Daxin

raises alarms for cyber-espionage investigators

A backdoor in use as recently as November 2021 is the “most advanced piece of malware” ever seen from China-linked spies, according to researchers at Symantec.

The cybersecurity company said Monday that the backdoor, dubbed Daxin, is part of “a long-running espionage campaign against select governments and other critical infrastructure targets,” most of them being of strategic interest to China. The malware “appears to be optimized for use against hardened targets, allowing the attackers to burrow deep into a target’s network and exfiltrate data without raising suspicions,” the researchers said.

“This isn’t really comparable to any other strains of China-linked malware in our opinion. It’s on another level,” Dick O’Brien, principal editor for the Symantec Threat Intelligence Team, told CyberScoop. “It would be near the same level as malware we’ve seen attributed to Western powers, but maybe not as well put together.”
...
In addition to government targets, Daxin has been used against entities in the telecommunications, transportation and manufacturing sectors, the report said. Some of the targets were identified with the help of threat intelligence specialists at consultancy PwC. Symantec said potential Daxin uses began as early as 2013.
...
Daxin allows attackers to read and write files and start processes, but “its real value to attackers lies in its stealth and communications capabilities,” Symantec said.

The malware is capable of hijacking legitimate TCP/IP connections and exchanging digital keys with a remote peer. (TCP/IP stands for “Transmission Control Protocol/Internet Protocol,” and is used to communicate between computers.) A successful key exchange then lets it open an encrypted communication channel for receiving commands and sending information back to the remote source.

“Daxin’s use of hijacked TCP connections affords a high degree of stealth to its communications and helps to establish connectivity on networks with strict firewall rules,” the Symantec report said. “It may also lower the risk of discovery by SOC [security operations center] analysts monitoring for network anomalies.”

“It’s notable in the way it integrates itself into legitimate machine behavior, generating no suspicious network traffic but also in the way it can create peer-to-peer networks of nodes of infected computers, allowing the attackers to penetrate deep into protected assets in targeted organizations,” he said.

[kyonides]

China carried out massive cyberattack operation on Ukraine

Ukraine's security service claimed China coordinated thousands of cyberattacks and hacking attempts on official Ukrainian government sites.

China launched a massive cyber operation against the Ukrainian military and its nuclear facilities before Russia began its invasion, according to UK intelligence reports obtained by The Times.

The British reports were backed up by Ukraine's national security service, the SBU, which claimed China coordinated thousands of cyberattacks and hacking attempts on official Ukrainian government sites.

Some of the sites targeted include over 600 websites belonging to Kyiv's defense ministry, a statement released by SBU claimed.

China's goal in the attacks was to steal data and explore ways to shut down Ukrainian defenses and civilian infrastructure, the SBU further claimed.

The attacks, which allegedly began prior to the end of the Winter Olympics in Beijing, peaked on February 23. Russian forces invaded Ukraine 24 hours later.

[kyonides]

Chinese hackers targeted U.S. political reporters just ahead of Jan. 6 attack

Hackers connected with the Chinese government engaged in numerous phishing campaigns targeting U.S.-based journalists since early 2021, with operations focused on political and national security reporters and White House correspondents in the days leading up to the Jan. 6 attack on the Capitol, researchers said Thursday.
...
Researchers with cybersecurity firm Proofpoint shared the details Thursday as part of a report looking at these kinds of operations carried out by China, Iran, North Korea and Turkey. The attacks both targeted journalists and had hackers posing as journalists to target others, the researchers said.
...
And posing as journalists allows hackers the ability to “spread disinformation or pro-state propaganda, provide disinformation during times of war or pandemic, or be used to influence a politically charged atmosphere,” the researchers added.
...
Cyberattacks on journalists and media organizations are nothing new. In 2013, The New York Times reported that Chinese hackers had been persistently attacking the paper over the course of several months in connection with reporting on then Chinese Prime Minister Wen Jiabao. In February of this year, The Wall Street Journal reported that hackers likely associated with China hacked and accessed emails and other documents of journalists and other employees in an intelligence collection effort.

And in November, the Department of Justice alleged that two Iranian hackers accessed the computer network of a media company with aims to modify content on news organizations’ websites as part of a sprawling election interference operation.

 How did they do it?

Chinese hackers associated with what are believed to be two distinct campaigns targeted U.S.-based journalists over the course of 2021 and into 2022, the researchers said. The first group, tracked by Proofpoint as TA412 but by Microsoft as Zirconium, used malicious emails with web beacons to collect information from targets’ systems spanning several months in early 2021.

The researchers identified five campaigns.
...
Emails sent to targets used subject lines pulled from recent articles, while the body of the email duplicated the text from those articles. Also included in the body was a PNG image file that connected to a hacker-controlled domain, a campaign identifier, victim identifier, campaign date and information about the image file.
...
A separate Chinese group, tracked by Proofpoint as TA459, targeted victims with a malicious document that, if opened, installed and executed Chinoxy malware. The malware gives an attacker a backdoor to a victim’s computer and allows them to maintain persistence, the researchers said.

The article above also mentioned  hacking groups based in North Korea, Turkey and Iran.  What a long list of bad guys indeed!