Specific evidence shows that the actor gained access to some of the penetrated networks via a Microsoft Exchange server, implying that the threat actors took advantage of a known vulnerability on unpatched devices. According to researchers, similar actions may continue now. The current malicious campaign led by Cicada began in the middle of 2021 and was still going strong in February 2022. Source Cicada Malicious Campaign: More Details The attribution of this activity to Cicada is based on the presence on victim networks of a custom loader and custom malware that are believed to be exclusively used by the APT group. However, this campaign does appear to indicate a further widening of Cicada’s targeting. Cicada’s initial activity several years ago was heavily focused on Japanese-linked companies, though in more recent times it has been linked to attacks on managed service providers (MSPs) with a more global footprint. The wide number of sectors and geographies of the organizations targeted in this campaign is interesting. (…) Victims in this Cicada (aka APT10) campaign include government, legal, religious, and non-governmental organizations (NGOs) in multiple countries around the world, including in Europe, Asia, and North America.
Its purpose is the launching of a custom malware loader by means of the VLC Media Player.Ī Chinese state-backed advanced persistent threat (APT) group is attacking organizations around the globe in a likely espionage campaign that has been ongoing for several months. A lasting malicious campaign employed by threat actors linked to the Chinese government has been recently discovered by security experts.
0 kommentar(er)
