Asian hackers hit sensitive targets in 37 nations in spying plot

"An Asian cyber-espionage group has spent the past year breaking into computer systems belonging to governments and critical infrastructure organizations in more than 37 countries, according to the cybersecurity firm Palo Alto Networks, Inc. The state-aligned attackers have infiltrated networks of 70 organizations, including five national law enforcement and border control agencies, according to a new research report from the company."

"They used that access to spy on emails, financial dealings and communications about military and police operations, the report states. The hackers also stole information about diplomatic issues, lurking undetected in some systems for months. They use highly-targeted and tailored fake emails and known, unpatched security flaws to gain access to these networks, said Pete Renals, director of national security programs with Unit 42, the threat intelligence division of Palo Alto Networks."

"Espionage appears to be the main motivation behind these attacks as the actors frequently seek access to email communications and other sensitive data. The US Cybersecurity and Infrastructure Security Agency said it was aware of the campaign. The agency is working with its partners to stop hackers from exploiting any of the vulnerabilities identified in the report, said Nick Andersen, CISA's executive assistant director for cybersecurity."

An Asian state-aligned cyberespionage group spent a year breaching computer systems of governments and critical infrastructure in over 37 countries, compromising networks of 70 organizations. Targets included five national law enforcement and border control agencies, three finance ministries, one parliament, and a senior elected official. The actors exfiltrated emails, financial data, military and police communications, and diplomatic materials while lingering undetected for months. Operations appeared timed with diplomatic missions, trade negotiations, political unrest, and military actions. The attackers used tailored spear‑phishing emails and exploitation of known unpatched vulnerabilities. U.S. cybersecurity authorities are coordinating with partners to mitigate exposed vulnerabilities.

Read at www.mercurynews.com