Unpatched Microsoft Exchange servers in various Asian countries were the target of an attack campaign discovered by Russian cybersecurity firm Kaspersky.
The threat actors exploited the above vulnerabilities to gain access to the industrial control systems (ICS) of telecommunications companies in Pakistan and Afghanistan, as well as a logistics and transportation company in Malaysia, according to a company advisory released on Monday.
In October 2021, Kaspersky discovered that hackers were exploiting the CVE-2021-26855 vulnerability in Microsoft Exchange to gain access to user data. In spite of this, signs of the attacks on the affected systems appear to date back to March of this year.
“During the investigation, researchers uncovered larger-scale activity by the threat actor in the network of the telecommunications company and also identified other victims of the campaign,”
At various points in this hacking campaign, a legitimate executable file called AppLaunch.exe was used to launch the ShadowPad backdoor on victims’ computers, according to reports.
A legitimate OLE-COM object viewing application, OleView, would then be hijacked by attackers to launch ShadowPad. In the beginning, the threat actors would send commands manually and then automatically.
Hackers are said to have used the CobaltStrike framework, the PlugX backdoor, and various BAT files during these cyberattacks. In the original advisory, you can find a complete list.
When it came to the attribution of these new attacks, Kaspersky stated that they had an almost entirely unique set of tactics, techniques, and procedures (TTP).
The attackers’ TTP enabled us to link these attacks to a Chinese-speaking threat actor, and we observed victims located in different regions. This means that the actor we have identified may have broader geographical interests and we could expect more victims to be discovered in different countries in the future.
While it is still unclear what the attacker’s ultimate goal is, the antivirus company has stated that they believe it may be data harvesting at the time of writing.
“We believe that it is highly likely that this threat actor will strike again and we will find new victims in different countries.”
Share this article
About the Author
Rebecca James is an IT consultant with forward thinking approach toward developing IT infrastructures of SMEs. She writes to engage with individuals and raise awareness of digital security, privacy, and better IT infrastructure.
More from Rebecca JamesRelated Posts
Google and FBI Disrupt NetNut Residential Proxy Network Used by 2M+ Devices
Google worked with the FBI and Lumen to disrupt the NetNut residential proxy network, also known as ...
Opera Launches Paste Protect to Block ClickFix Clipboard Attacks
Opera’s Paste Protect blocks harmful commands from reaching the clipboard, preventing ClickFix...
Reddit Introduces Mandatory Age Verification for EU Teens Accessing NSFW Content
Reddit will require European Union users under 18 to verify their age before viewing mature or NSFW ...
Popular ‘Adblock for YouTube’ Chrome Extension Found With Remote Code Execution Risk
The popular “Adblock for YouTube” Chrome extension now carries an architectural weakness...
Texas Hunting and Fishing License Data Breach Affects 3 Million Customers
Approximately 3 million Texas hunting and fishing license customers were affected by a data breach i...
FBI Warns of ‘Kali365’ Subscription Service Targeting Microsoft 365 Accounts
The FBI’s sounding the alarm on Kali365, a site where criminals can pick up ready-to-use tools for s...
