Chinese, Russian hackers linked to major global cyber attack
The maker of a popular app has called for users to immediately update software after two global cyber attacks breached hundreds of government and private networks. Are you targeted?
World
Don't miss out on the headlines from World. Followed categories will be added to My News.
Hundreds of public and private networks have been breached in two global cyber attacks linked to Chinese spies and Russian-backed hacking groups, according to US intelligence agencies and a Google-owned cybersecurity firm.
The US Cybersecurity and Infrastructure Security Agency (CISA) said they were “working to understand the impacts” to several US federal government agencies hit in the global cyber attack on Thursday, local time.
It comes as the Google-owned cybersecurity firm Mandiant announced suspected Chinese hackers breached hundreds of public and private networks around the world since October last year, with “high confidence” the group was engaged in “espionage activity in support of the People’s Republic of China.”
“This is the broadest cyber espionage campaign known to be conducted by a China-nexus threat actor since the mass exploitation of Microsoft Exchange in early 2021,” Charles Carmakal, Mandiant’s chief technical officer said in a statement to AP.
Australia and its Five Eyes security allies in late May warned that Chinese state-sponsored cyber espionage group Volt Typhoon was responsible for cyber attacks targeting “critical infrastructure” in the United States and the Pacific.
While CISA did not confirm who carried out the latest attacks targeting America’s critical infrastructure, CNN reported that a Russian-speaking ransomware group known as CLOP has claimed credit for other victims in the hacking campaign that began two weeks ago targeting universities and state governments.
CISA’s executive assistant director for cybersecurity, Eric Goldstein, said in a statement that the breach affected MOVEit, a widely used file transfer application that was first exploited by the Russian-backed hackers.
Owners of the MOVEit software have urged victims to update their software and issued security advice for organisations to follow mitigation steps to hunt for malicious activity.
Jen Easterly, the director of the US Cybersecurity and Infrastructure Security Agency, added to MSNBC they did not expect a “significant impact” to government agencies.
In a blog post on Thursday, local time, Mandiant said Chinese hackers breached hundreds of public and private networks through a software vulnerability in Barracuda Networks’ Email Security Gateway. The “zero-day” exploit was being used as early as October 2022 before Barracuda announced the vulnerability on May 23.
“Overall, Mandiant identified that this campaign has impacted organisations across the public and private sectors worldwide, with almost a third being government agencies,” the blog post said.
More than half, 55 per cent, of victims were in the Americas with the remainder in Europe, 24 per cent, and in the Asia Pacific, 22 per cent.
Among the recent organisations to publicly announce breaches in the US are Baltimore’s Johns Hopkins University, and more than a dozen universities and colleges in the state of Georgia.
Barracuda recommended all customers isolate and replace compromised appliances and conduct investigations into impacted networks.
Details of the cyber attacks come less than a month after US’s National Security Agency said it was working with the security agencies of Australia, New Zealand, the UK, and Canada to identify cyber security breaches, identifying China’s Volt Typhoon as using built-in network administration tools to blend in with Microsoft Windows operating systems and avoid detection.
“Cyber actors find it easier and more effective to use capabilities already built into critical infrastructure environments. A PRC state-sponsored actor is living off the land, using built-in network tools to evade our defences and leaving no trace behind,” said Rob Joyce, NSA Cybersecurity Director.
“That makes it imperative for us to work together to find and remove the actor from our critical networks.”
Originally published as Chinese, Russian hackers linked to major global cyber attack
Eerie note found, as 22yo remains missing
A father has shared the eerie contents of a shakily handwritten note from his son on the last day he was heard from.
US to send troops, anti-missile system to Israel
The US will send Israel an advanced anti-missile system and 100 troops, as Benjamin Netanyahu told the UN to remove its Lebanon peacekeepers, and bombshell documents reveal Hamas planned a 9/11 type attack. Follow the updates.