Chinese hack group APT10 attacks Taiwanese financial sector

According to CyCraft, a Taiwanese security company, the Chinese hack group APT10 (aka Stone Panda, MenuPass and Bronze Riverside) has been attacking the local financial sector for many months, exploiting a vulnerability in an unnamed security product that is used by about 80% of local financial institutions.

It is believed that the attacks began at the end of November 2021 and are still ongoing.

According to Taiwan News, in 2021, the frequency of cyberattacks against Taiwanese institutions increased by 38%, reaching an average of 2,644 attacks per week. On average, there are 925 attacks per week around the world. This discrepancy is due to Taiwan’s unique geopolitical position.CyCraft researchers say.

The name of the product being exploited by the hackers has not yet been revealed due to an ongoing investigation by law enforcement agencies, as well as attempts by specialists to release and distribute patches to local financial institutions.

The attacks went unnoticed for so long as they were initially misclassified. The fact is that IN November 2021 attacks hackers used a vulnerability in the software that was missed, but the use of credential stuffing tactics was noticed, which APT10 used as a cover and as a way to gain access to some trading accounts, which were then used to carry out large transactions in the stock market.

Now the researchers say that it was all just a “screen”. In fact, APT10 exploited a vulnerability in an unnamed security product, injected the ASPXCSharp web shell, and then used the Impacket tool to scan the target’s internal network. After that, the attackers used the reflective code loading technique to run malicious code on local systems and install Quasar RAT open-source malware, which allowed hackers to gain remote access to the infected system using RDP reverse tunnels.

Further investigation revealed that two separate waves of cyberattacks were in fact one long-term campaign in which the attackers used previously unknown obfuscation techniques. The purpose of these attacks, apparently, was not for financial gain, but to steal brokerage information, PII data and interfere with investment during Taiwan’s economic growth.CyCraft experts say.

Let me remind you that we also wrote that Chinese hackers attacked Ragnarok Online Developers, and also that DeadRinger attack targets telecommunications companies in Southeast Asia.

Sending