China’s APT40 group can exploit vulnerabilities within hours of public release
- by nlqip
“Typically, after successful initial access APT40 focuses on establishing persistence to maintain access on the victim’s environment,” said the advisory. “However, as persistence occurs early in an intrusion, it is more likely to be observed in all intrusions regardless of the extent of compromise or further actions taken.”
A concerning trend identified in the advisory is APT40’s growing use of compromised devices including small-office or home-office (SOHO) devices as “operational infrastructure and last-hop redirectors” for launching attacks.
These devices, often unpatched and outdated, offer a vulnerable entry point for the group. By compromising SOHO devices, APT40 can mask their activity within legitimate traffic, making detection more challenging for defenders.
Source link
lol
“Typically, after successful initial access APT40 focuses on establishing persistence to maintain access on the victim’s environment,” said the advisory. “However, as persistence occurs early in an intrusion, it is more likely to be observed in all intrusions regardless of the extent of compromise or further actions taken.” A concerning trend identified in the advisory…
Recent Posts
- NetApp CEO Says Don’t Call NetApp A Storage Company
- CISA proposes new security requirements to protect govt, personal data
- Unisys, Check Point, Mimecast, Avaya Fined By SEC Over SolarWinds-Related Breaches
- Lenovo ISG Leader Says ‘Meet-In-The-Channel’ AI Solutions Made For Partners To Deliver Value
- Google Voice scams: What are they and how do I avoid them?