Eight countries have warned about the speed and efficiency of China-based hackers accessing government networks.
What happened
Cybersecurity agencies from Australia, the U.S., the U.K., Canada, New Zealand, Germany, the Republic of Korea, and Japan have released a joint advisory warning about the Chinese hacker group APT40, also known as Kryptonite Panda, Gingham Typhoon, Leviathan, and Bronze Mohawk. The group has been targeting government and private sector networks, particularly in Australia and the United States, exploiting vulnerabilities in small-office and home-office devices to launch attacks. APT40 is linked to the Chinese Ministry of State Security.
The backstory
APT40 has been a persistent threat, relying on outdated and vulnerable infrastructure to conduct its operations. The group's preference for exploiting public-facing infrastructure over user-interaction techniques like phishing has allowed them to infiltrate networks efficiently. They have been particularly effective in exploiting software such as Log4J, Atlassian Confluence, and Microsoft Exchange, with some vulnerabilities dating back to 2017.
Related: Combating phishing in healthcare
Going deeper
- APT40’s tactics: The group rapidly adopts new exploit proof-of-concepts, regularly conducts surveillance, and targets end-of-life devices.
- Targeted vulnerabilities: Focus on outdated software and devices no longer supported with security updates.
- Persistent access: After initial access, APT40 aims to establish persistent access to maintain a foothold in the victim’s environment.
What was said
"The group appears to prefer exploiting vulnerable, public-facing infrastructure over techniques that require user interaction such as phishing campaigns," said the Australian Signals Directorate (ASD). "Typically, after successful initial access APT40 focuses on establishing persistence to maintain access on the victim’s environment." The U.K.'s National Cyber Security Centre added, "These devices are softer targets when they are not running the latest software, or are no longer supported with security updates."
In the know
APT40's activities indicate the importance of maintaining up-to-date software and security patches. Small-office and home-office devices are particularly vulnerable due to their often outdated or unsupported status. Both government and private sector entities must understand these risks to strengthen their cybersecurity defenses.
Why it matters
The efficiency and adaptability of APT40's operations are a significant threat to national security and private sector networks. Their ability to quickly exploit new vulnerabilities and maintain persistent access increases the risk of data breaches and unauthorized access. The warning reinforces the urgent need for robust cybersecurity measures and international cooperation to combat these sophisticated cyber threats.
Related: Preventing the spread of cybersecurity attacks in healthcare
FAQs
What are some common cybersecurity threats in healthcare?
Common threats include ransomware attacks, phishing scams, and data breaches that target sensitive patient information and disrupt healthcare operations.
How can healthcare organizations protect against ransomware attacks?
Organizations can protect against ransomware by implementing regular data backups, employee training on recognizing phishing emails and maintaining up-to-date security software.
What is the role of encryption in healthcare cybersecurity?
Encryption protects sensitive data by converting it into a coded format that is unreadable without a decryption key, ensuring patient information remains confidential during transmission and storage.
Liyanda Tembani
