Legacy IT infrastructure hosted Chinese spies inside a US engineering firm
for months

Date:
Thu, 19 Sep 2024 17:28:00 +0000

Description:
Binary Defense highlights the risk of shadow IT and unmanaged endpoints.

FULL STORY ======================================================================

Chinese state-sponsored hackers were snooping around a US-based global engineering firm for months, trying to steal classified information, blueprints, login credentials , and other sensitive data.

An exclusive report by The Register , discussed the news with John Dwyer, Director of Security Research at Binary Defense, a managed detection and response firm that was brought in to investigate, once the attack was discovered.

The target company was not named, but it was describes as making, components for public and private aerospace organizations and other critical sectors, including oil and gas. The hacking collective was also not precisely identified, although the researchers did say they believed it to be Chinese, and state-sponsored, at that. Unmanaged IT

The group made its way into the companys infrastructure through three unmanaged AIX servers. These IBM-made servers are running the Advanced Interactive eXecutive operating system, a UNIX-based OS, and apparently,
still had the default login credentials. That allowed threat actors to brute-force their way in, after which they established persistence and lurked for months. The researchers believe the intrusion originally occurred in
March this year.

The groups goal was to harvest information, which could later probably be
used in supply chain attacks. Since the organization makes gear for critical sectors, the risk of important hardware going bust was real.

The victim company had endpoint detection and response (EDR) systems set up. However, these AIX servers were so old that they werent compatible with the EDR and as such were not monitored. The Register described them as long- or almost-forgotten machines, shadow IT deployments that are often not managed
at all.

However, when the crooks tried to dump the memory of the LSASS process on a Windows server (a common way to harvest credentials," the publication
states), they were spotted, and blocked.

Via The Register More from TechRadar Pro Chinese government hackers infiltrate at least two top US ISPs Here's a list of the best firewalls
around today These are the best endpoint security tools right now



======================================================================
Link to news story: https://www.techradar.com/pro/security/legacy-it-infrastructure-hosted-chinese -spies-inside-a-us-engineering-firm-for-months


--- Mystic BBS v1.12 A47 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)