US critical infrastructure hit once again by a new group on the scene

Date:
Fri, 06 Dec 2024 16:00:00 +0000

Description:
The group seems to be part of a wider cyber-espionage campaign.

FULL STORY

Storm-0227, a Chinese state-sponsored advanced persistent threat (APT) actor started targeting critical infrastructure organizations, as well as
government entities, in the United States.

This is according to Sherrod DeGrippo, director of threat intelligence
strategy at Microsoft.

Speaking to The Register recently, DeGrippo said that the group abuses
software vulnerabilities and engages in spear phishing attacks to gain access to peoples devices.

Commodity malware

Once they get the access, they deploy different Remote Access Trojans (RAT)
and other malware to obtain login credentials for services such as Microsoft 365 . They also steal sensitive documents and whatever else they can get
their hands on. The goal of the campaign is cyber-espionage.

An interesting thing about Storm-0227 is that it uses off-the-shelf malware which, a few years ago, would come as quite the shock: Even national-aligned threat actors are pulling commodity malware out of that trading ecosystem
and using it for remote access," she told the publication. Half a decade ago "that was sort of a shocking thing to see a nation-sponsored,
espionage-focused threat actor group really leveraging off the shelf
malware," she added. "Today we see it very frequently."

There was no word on the number of victims, but DeGrippo described the group
as an embodiment of persistence.

"China continues to focus on these kinds of targets," she said. "They're pulling out files that are of espionage value, communications that are contextual espionage value to those files, and looking at US interests."

Storm-0227 seems to overlap, at least in part, with Silk Typhoon, it was further said. There is a whole list of typhoon threat actors, all on the payroll of the Chinese government, and all apparently tasked with spying on western governments, critical infrastructure firms, and other areas of
interest (military, aerospace, and similar).

That includes Volt Typhoon, Salt Typhoon, Flax Typhoon, and Brass Typhoon.
Salt Typhoon was recently linked to a number of high-profile breaches, including at least four major US telecom operators.

Via The Register

======================================================================
Link to news story: https://www.techradar.com/pro/security/us-critical-infrastructure-hit-once-aga in-by-a-new-group-on-the-scene

$$
--- SBBSecho 3.20-Linux
* Origin: capitolcityonline.net * Telnet/SSH:2022/HTTP (1:2320/105)