Chinese Cyberespionage Using Open Source VPN

Every week, ISMG rounds up cybersecurity incidents and breaches around the world. This week, Chinese cyberespionage hacking groups like SoftEther VPN, the Italian dossier hacking scandal got a Vatican and Israel connection, the FBI warned corporations to be leery of high pressure emergency requests for data. Also, Okta fixed an unusual bug, Google will mandate multifactor authentication and hackers exploited a zero day in PTZOptics cameras. A Mexican airport operator didn’t pay a ransom, a hacker group demanded baguettes from a French multinational, and an Ohio city began alerting 500,000 individuals about a data breach. Germany proposed to shield white hats, the Italian data protection authority admonished a bank, and Ireland said it had an okay year for hacking.

See Also: Gartner Guide for Digital Forensics and Incident Response

Chinese cyber espionage hacking groups have a tool of choice, says threat intelligence covering six months of detected nation state threat actor activity from April through September from cybersecurity firm Eset.

The firm in a report published Thursday said several “China aligned” groups are relying more and more on SoftEther VPN. The Japanese university behind the project describes it as an “open-source free cross-platform multi-protocol VPN program.” Its attraction to Chinese hackers is that it can use HTTPS to establish a tunnel, “facilitating firewall bypass while blending into legitimate traffic,” Eset said.

Among the Chinese users of SoftEther VPN or a SoftEther VPN bridge: Flax Typhoon – also known as RedJuliett, Gallium and MirrorFace, also known as Earth Kasha.

MirrorFace focuses on Japanese hackers, so Eset researchers were surprised to see it over the summer also attacking “a diplomatic organization” in the European Union, the first time that Eset detected the threat actor targeting a European organization. But the hacking was still connected to Japan – the social engineering lure used in the campaign were the upcoming World Expo set to be held in 2025 in Japan. “Even considering this new geographic targeting, MirrorFace remains focused on Japan and events related to it,” Eset said.

Eset researchers also highlight mounting sophistication by a Russian threat actor that targets Ukraine. The group, tracked as Gamaredon or Armageddon, has “improved already existing malicious tools and employed new ones.” Among those new tools: a PowerShell tool Eset dubs PteroGraphin, a downloader that delivbers an encrypted payload through through the Telegram social media network.

Gamaredon hackers – who are regular officers of the FSB and some former law enforcement officers of Ukraine, the Security Service of Ukraine said in 2021 – also reworked a PowerShell backdoor tracked as PteroPSDoor to make it stealthier. They reworked PteroSig, a data exfiltration tool it uses against the Signal texting platform desktop app to accommodate improved security measures implemented in July.

A Milan private intelligence firm caught up in an Italian hacking scandal may have undertaken hacking activities for international clients, including the Vatican and the Israeli government.

Italian authorities in October placed four individuals under house arrest for their connections with the company, Equalize, accused of illicitly accessing government databases to build dossiers for blackmailing businessmen and politicians (see: Private Firm Accessed Italian Govt Database: Prosecutors).

Italian media last week reported that alleged Equalize clientele included Israeli intelligence and the Vatican, based on leaked wiretaps.

The Vatican allegedly wanted information about Russian oligarchs and the private mercenary group Wagner. Israeli intelligence reportedly sought information related to “Qatargate,” a political controversy linked to European politicians and lobbyists working for the governments of Qatar, Morocco and Mauritania.

La Stampa reported that Equalize operations were supported by a group of unidentified individuals, with IT infrastructure hosted in the United States and Lithuania.

The FBI is warning that criminals with access to compromised U.S. and foreign government email accounts are using them to spoof corporations into committing a data breach.

Threat actors are selling access to government email accounts along with instructions for using them in “emergency data request” scams. For an additional $100, attackers can obtain instructions on exploiting these credentials to impersonate law enforcement and request sensitive data without traditional verification, exploiting the urgent nature of emergency requests.

This type of attack was first noted by the FBI in August 2023. “Private sector companies receiving law enforcement requests should apply critical thinking to any emergency data requests received,” the bureau advised.

Okta patched an unusual vulnerability in its Active Directory/Lightweight Directory Access Protocol delegated authentication. The flaw allowed cybercriminals under specific conditions to bypass authentication using only a username. Specifically, usernames of 52 characters or more – a scenario possible if an email address was used as a username, especially with longer domain names.

The bypass could occur if a user had previously authenticated, creating a cached credential that would be used if the AD/LDAP agent was temporarily unreachable, such as during periods of peak network traffic. Discovered on Oct 30, the vulnerability had been present since July. Okta advised customers to review logs for unusual authentication attempts dating back to July 23. Okta has fixed the issue.

Google announced Monday that multifactor authentication will be mandatory for all Google Cloud accounts by the end of 2025, a move aimed at enhancing account security amid growing cyber threats. The requirement will apply to all Google Cloud users, including admins, but not to general consumer Google accounts.

The rollout will occur in three phases. Starting this month, users without MFA will receive reminders on their console screens. Early in 2025, both new and existing users will be notified to enable MFA across various Google Cloud platforms, including Firebase and gCloud. By the end of 2025, MFA will be mandatory for all users, who may use either their own identity provider’s MFA or an additional layer through Google.

Hackers are exploiting two zero-day vulnerabilities, CVE-2024-8956 and CVE-2024-8957, in PTZOptics cameras used in various sectors, including healthcare and government. GreyNoise detected the flaws through its honeypot network, finding exploitation attempts aimed at the cameras’ CGI-based API and embedded ntp_client to execute commands.

CVE-2024-8956 involves weak authentication in the lighttpd server, exposing usernames, password hashes and network data. CVE-2024-8957 enables remote code execution through a command injection flaw in the ntp_client binary. Together, these vulnerabilities allow complete camera takeover, bot infections, or lateral movement within networks.

GreyNoise collaborated with VulnCheck for disclosure, and PTZOptics released an update but certain older models received no patch due to end-of-life status. More recent models like PT20X-SE-NDI-G3 and PT30X-SE-NDI-G3 also remain unpatched.

The Mexican airport operator known as OMA confirmed Tuesday that an October ransomware attack resulted in the breach of information about commercial partners, customers and employees. The firm, Grupo Aeroportuario del Centro Norte, said it didn’t pay extortion after criminal group RansomHub published on its leak site what it said was 3 terabytes of stolen data.

OMA operates 13 terminals including Monterrey International Airport, located in Mexico’s second largest urban area. In a statement statement transmitted to stock exchange Bolsa Mexicana de Valores, OMA said it is hardening cyber defenses including its ability to detect and respond to possible new incidents.

The attack, it also said, did not cause material effects to its operations, outcomes or financial situation. Mexican media reported the incident disrupted flight information displays and parking machines, with the company rolling out portable displays inside terminals by late October.

Hacker group “Grep,” rebranded as “Hellcat ransomware gang,” said it infiltrated French multinational Schneider Electric’s project tracking system, stealing 40 gigabytes of data. The attackers claim to have accessed Schneider’s Atlassian Jira server using exposed credentials, extracting 400,000 rows of sensitive data, including employee and customer names, emails, and project files.

On its dark web leak site and in a social media post on X, the hackers demanded a ransom of $125,000 in “baguettes” to prevent public release of the data. Addressed to “Olivier,” likely Schneider’s new CEO Olivier Blum, the message included a “half-price discount” offer if Schneider publicly acknowledged the breach.

Schneider Electric has said it’s investigating the Hellcat claims.

The city of Columbus, Ohio, alerted 500,000 residents about potential data exposure following a ransomware attack in mid-July 2024.

The Rhysida ransomware group, suspected of Russian ties, claimed responsibility, demanding a ransom for the 6.5 terabytes of stolen data. When negotiations failed, Rhysida leaked 3.1 terabytes, marking one of the largest public sector breaches in recent history.

Affected information includes names, dates of birth, bank account information, identifiers including driver’s licenses and Social security numbers “and other identifying information concerning you and/or your interactions with the city,” states the breach notification letter.

Germany’s Federal Ministry of Justice drafted a law to legally protect security researchers who identify and responsibly report IT vulnerabilities. Federal Minister of Justice Marco Buschmann stated the bill aims to recognize the contributions of ethical hackers, not penalize them.

Under the proposed bill, researchers would be exempt from criminal liability if their actions are conducted solely to discover vulnerabilities and responsibly report them. The criteria include acting to identify risks, reporting to relevant entities such as vendors or the Federal Office for Information Security and ensuring system access is only as extensive as necessary for testing.

The draft also introduces harsher penalties, ranging from three months to five years, for severe cases of malicious data spying, especially when critical infrastructure or national security is compromised.

Italy’s data protection authority Garante accused the country’s largest bank, Intesa Sanpaolo, of downplaying the scope of a data breach. The breach from July involved a former employee accessing sensitive customer data more than 6,000 times between February 2022 and April 2024. Victims of the breach include Prime Minister Giorgia Meloni, her family, and other high-profile figures, such as former Prime Ministers Mario Draghi, Enrico Letta and Matteo Renzi (see: Breach of Italian Prime Minister’s Bank Info Under Scrutiny).

Garante criticized the bank’s response, stating that it failed to adequately assess and report the risks to individuals’ rights and freedoms. The regulator said it became aware of the breach’s impact through media reports rather than direct communication. The data authority on Tuesday gave Intesa Sanpaolo 20 days to notify affected customers and 30 days to provide a plan for security improvements.

Ireland recorded a spike in self-proclaimed hacktivist network disruptions and ransomware attacks in 2023, with the country’s cyber agency receiving 721 reports of confirmed cyber incidents.

In its first annual cyberthreat report released Monday, the Irish National Cyber Security Center said the majority of incidents were either moderate or isolated in severity. The country did not record any severely disruptive attacks in 2023. “This shows the successful preventative work being done by the NCSC to ensure threats are being stopped before they can severely impact the state’s infrastructure,” it asserted.

Other Stories From Last Week

With reporting from Information Security Media Group’s Akshaya Asokan in Southern England and David Perera in Washington, D.C.