Chinese spies spent 4 months in aerospace firm’s server
www.theregister.com
Getting sloppy, Xi

Archived link

Chinese state-sponsored spies have been spotted inside a global engineering firm’s network, having gained initial entry using an admin portal’s default credentials on an IBM AIX server.

Binary Defense’s Director of Security Research John Dwyer said the cyber snoops first compromised one of the victim’s three unmanaged AIX servers in March, and remained inside the US-headquartered manufacturer’s IT environment for four months while poking around for more boxes to commandeer.

It’s a tale that should be a warning to those with long- or almost-forgotten machines connected to their networks; those with shadow IT deployments; and those with unmanaged equipment. While the rest of your environment is protected by whatever threat detection you have in place, these legacy services are perfect starting points for miscreants.

[…]

This particular company, which Dwyer declined to name, makes components for public and private aerospace organizations and other critical sectors, including oil and gas. The intrusion has been attributed to an unnamed People’s Republic of China team, whose motivation appears to be espionage and blueprint theft.

[…]

  • treadful@lemmy.zipEnglish
    6·
    3 months ago

    “And immediately after we had removed them from the environment, another attack set off, which we attributed to the same group trying to get back in through other means,” he added.

    This happened within 24 hours, with a credential-stuffing attack. “There was no opsec, no slow-and-low,” Dwyer said. “They put the persistent in APT. Once they identify a target as valuable to them and their goals and objectives, they will continue to try to get back in.”

    And this is from a company that seems to at least sort of take security seriously (ignoring the glaring error that got them in this situation). Responding to this threat seems like a challenge for most companies down the supply chain.