The CSA details how multiple China-nexus threat actors are now using external covert networks to facilitate malicious cyber activity strategically, at scale. These dynamic covert networks include botnets that leverage many compromised devices to connect across the internet in a low-cost, low-risk, deniable way, disguising the origin and attribution of malicious activity. These botnets frequently include compromised small office/home office network infrastructure (routers, firewalls, network attached storage, etc.) and internet of things devices (web cameras, video recorders, smart devices, etc.).

While many new covert infrastructure networks are regularly developed and deployed for use by multiple China-nexus threat actors, existing networks are also updated because of defensive or legal action, software updates, or new exploits being used to target different technologies, according to the CSA. This renders a detailed list of all known networks (how they are constructed and communicated) and previous defense paradigms ineffective. Legitimate users also browse the internet using the networks and devices involved, making attribution of the malicious activity challenging. However, since most networks of compromised infrastructure use the same basic set up, understanding the generalized structure can help aid in defensive efforts.

This CSA explains the widespread shift in tactics, techniques, and procedures by malicious cyber actors away from using individually procured infrastructure to multiple externally managed large covert networks used by many actors simultaneously. It describes the typical makeup of a covert network and how it is used, and includes protective advice for organizations targeted by cyber activity using a covert network as an access vector. Additionally, the guidance outlines tailored steps organizations of all sizes can take to mitigate the risk of attacks.

Anyone who is a target of China-nexus threat actors may be impacted by the use of covert networks, and anyone using a vulnerable device could have their device co-opted into one of these China-nexus covert networks. Cybersecurity analysts and network defenders — including those protecting national security, Department of War, and Defense Industrial Base systems — are advised to use the protective advice and mitigations listed in this CSA to thwart malicious activities.

Read the full report.

Source: NSA

If you enjoyed this article, please consider becoming a paid subscriber. Your support helps keep our site ad-free.

The post NSA releases joint guidance on defending against China-nexus covert networks appeared first on Intelligence Community News.

The malicious activity outlined in the advisory partially overlaps with cybersecurity industry reporting on Chinese state-sponsored threat actors referred to by names such as Salt Typhoon.

These activities have been linked to multiple China-based entities—including Sichuan Juxinhe Network Technology Co. Ltd., Beijing Huanyu Tianqiong Information Technology Co., Ltd., and Sichuan Zhixin Ruijie Network Technology Co., Ltd.—which provide cyber products and services to China’s Ministry of State Security and People’s Liberation Army.

The CSA, “Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide to Feed Global Espionage System,” details specific tactics, techniques, and procedures (TTPs) these actors have been found using for initial exploitation, persistence, collection, and exfiltration. Indicators of compromise (IOCs) and common vulnerabilities and exposures (CVEs) exploited by the APT actors are also detailed.

Further, the report provides threat hunting guidance and specific mitigations that organizations are encouraged to implement to search for malicious activity and reduce the threat of Chinese state-sponsored and other APT actors. These recommendations are especially important for network defenders of telecommunications and critical infrastructure organizations to discover unknown intrusions and prevent undetected malicious activity on their networks. By utilizing the outlined guidance, organizations can also better provide compromise details to appropriate authorities to continue improving all parties’ understanding of initial access methods.

When threat hunting, the authoring agencies advise that organizations gain a full understanding of the APT actors’ accesses before implementing visible incident response and mitigation actions to maximize the chance of achieving full eviction from compromised networks.

This CSA is being released by the following authoring and co-sealing agencies:

• United States National Security Agency (NSA)
• United States Cybersecurity and Infrastructure Security Agency (CISA)
• United States Federal Bureau of Investigation (FBI)
• United States Department of Defense Cyber Crime Center (DC3)
• Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC)
• Canadian Centre for Cyber Security (Cyber Centre)
• Canadian Security Intelligence Service (CSIS)
• New Zealand National Cyber Security Centre (NCSC-NZ)
• United Kingdom National Cyber Security Centre (NCSC-UK)
• Czech Republic National Cyber and Information Security Agency (NÚKIB)
• Finnish Security and Intelligence Service (SUPO)
• Germany Federal Intelligence Service (BND)
• Germany Federal Office for the Protection of the Constitution (BfV)
• Germany Federal Office for Information Security (BSI)
• Italian External Intelligence and Security Agency (AISE)
• Italian Internal Intelligence and Security Agency (AISI)
• Japan National Cyber Office (NCO)
• Japan National Police Agency (NPA)
• Netherlands Defence Intelligence and Security Service (MIVD)
• Netherlands General Intelligence and Security Service (AIVD)
• Polish Military Counterintelligence Service (SKW)
• Polish Foreign Intelligence Agency (AW)
• Spain National Intelligence Centre (CNI)

Read the full report here.

Source: NSA

IC News delivers the situational awareness you need to get ahead and stay ahead in the IC contracting space. Subscribe today for full access to 10,000+ articles, plus new articles each weekday.

The post China state-sponsored actors targeting CI orgs, according to NSA appeared first on Intelligence Community News.

The Cybersecurity Information Sheet (CSI), “Enhanced Visibility and Hardening Guidance for Communications Infrastructure,” provides defensive measures to strengthen visibility – detailed insight into network traffic, user activity, and data flow – for engineers and system administrators overseeing communications infrastructure. The guidance may also be applicable to organizations with on-premises enterprise equipment. The CSI also covers hardening of devices and network architecture to limit potential entry points for this type of cyber threat.

“Vigilance is key for defending against network compromise,” said Dave Luber, NSA cybersecurity director. “Always have eyes on your systems and patch and address known vulnerabilities before they become targets.”

The malicious cyber activity referenced in the CSI targeted exposed and vulnerable services, unpatched devices, and generally under-secured environments. The CSI recommends enhancing visibility for edge devices at network perimeters by logging all configuration changes and management connections and alerting on any unexpected ones. It also highlights numerous hardening best practices, including disabling all unused, unauthenticated, or unencrypted protocols; using and storing passwords securely; limiting management connections and privileged accounts; patching and upgrading devices in a timely manner; and allowing only strong cryptography.

The CSI also notes specific hardening best practices for Cisco operating systems, which were targeted by the PRC-affiliated threat actor.

Read the full report here.

Source: NSA

IC News delivers the situational awareness you need to get ahead and stay ahead in the IC contracting space. Subscribe today for full access to 10,000+ articles, plus new articles each weekday.

The post NSA issues guidance to defend against PRC-affiliated threat actor appeared first on Intelligence Community News.

The Cybersecurity Advisory (CSA) released by the agencies, “People’s Republic of China-Linked Actors Compromise Routers and IoT Devices for Botnet Operations,” highlights the threat posed by these actors and their botnet, a network of compromised nodes positioned for malicious activity.

“The botnet incorporates thousands of U.S. devices with victims in a range of sectors,” said Dave Luber, NSA cybersecurity director. “The advisory provides new and timely insight into the botnet infrastructure, the countries where compromised devices are located, and mitigations for securing devices and eliminating this threat.”

Device vendors, owners, and operators are encouraged to update and secure their devices – particularly older devices – from being compromised and joining the botnet. Cybersecurity companies are also urged to use the CSA to help identify malicious activity.

Compromised internet-connected devices include small office/home office (SOHO) routers, firewalls, network-attached storage (NAS), and Internet of Things (IoT) devices, such as webcams, DVRs, and IP cameras. The actors create a botnet from these devices, which can be used to conceal their online activity, launch distributed denial of service (DDoS) attacks, or compromise U.S. networks.

As of June 2024, the botnet consisted of over 260,000 devices in North America, Europe, Africa, and Southeast Asia, according to the CSA.

NSA is releasing this joint advisory to help National Security Systems, Department of Defense, and Defense Industrial Base networks mitigate these cyber threats. The authors of the CSA recommend the following mitigations:

• Regularly apply patches and updates, using automatic updates from trusted providers when available.
• Disable unused services and ports, such as automatic configuration, remote access, or file sharing protocols, which threat actors may abuse to gain initial access or to spread malware to other networked devices.
• Replace default passwords with strong passwords.
• Implement network segmentation with the principle of least privilege to ensure IoT devices within a larger network pose known, limited, and tolerable risks.
• Monitor for high network traffic volumes to detect and mitigate DDoS incidents.
• Plan for device reboots to remove non-persistent malware.
• Replace end-of-life equipment with supported devices.

Read the full report here.

Source: NSA

Stay in the know with breaking news from across the IC and IC contracting landscape by becoming a paid subscriber to IC News. Your support makes our work possible.

The post NSA warns about PRC-Linked actors and botnet operations appeared first on Intelligence Community News.

The cyber actor group has targeted organizations in various countries, including the United States and Australia. The group’s activity and tradecraft overlaps with groups tracked in industry reporting as APT 40, Kryptonite Panda, GINGHAM TYPHOON, and Bronze Mohawk.

“APT 40 is a known cyber actor group that continues to practice cyber espionage and evolve its tradecraft to target government networks,” said Dave Luber, NSA’s director of cybersecurity. “NSA joins in partnership with ASD, along with other co-sealers, to address the issue and arm network defenders with the information to counter future cyber threats.”

The CSA describes how APT 40 can rapidly exploit new public vulnerabilities in widely used software. Additionally, the group has evolved its tradecraft and embraced a global trend to use compromised devices, including home office devices, as operational infrastructure. Other PRC state-sponsored actors are using the same techniques, posing a threat to networks worldwide.

The CSA also details findings from the ASD’s investigations into the successful compromise of two organizations’ networks by the cyber actor group, including the key activities observed. It describes mitigations network defenders can take, including implementing comprehensive and historical logging, promptly patching all Internet exposed devices, segmenting networks to limit or block lateral movement, closely monitoring services to ensure they are well secured, and disabling unused or unnecessary network services, ports, and protocols.

Read the full report here.

Source: NSA

Your competitors read IC News each day. Shouldn’t you? Learn more about our subscription options, and keep up with every move in the IC contracting space.

The post NSA publishes case studies on PRC tradecraft appeared first on Intelligence Community News.

“To overcome their shortcomings, China’s People’s Liberation Army (PLA) has been aggressively recruiting Western military talent to train their aviators, using private firms around the globe that conceal their PLA ties and offer recruits exorbitant salaries. Recent actions by Western governments have impacted these operations, but PLA recruitment efforts continue to evolve in response,” said NCSC Director Michael C. Casey. “Today’s joint bulletin by FVEY partners seeks to highlight this persistent threat and deter any current or former Western service members from actions that put their military colleagues at risk and erode our national security.”

The joint bulletin provides information on this threat, as well as indicators, impact, mitigation, and where to report incidents.

Source: ODNI

Your competitors read IC News each day. Shouldn’t you? Learn more about our subscription options, and keep up with every move in the IC contracting space.

The post FVEY partners issue warning of PRC recruitment efforts appeared first on Intelligence Community News.

The CSA focuses on PRC-sponsored cyber actor, Volt Typhoon, targeting IT networks of communications, energy, transportation, water, and wastewater organizations in the U.S. and its territories. The authoring agencies recognize the reality that the PRC has already compromised these systems. In some cases, the cyber actors have been living inside IT networks for years to pre-position for disruptive or destructive cyberattacks against operational technology (OT) in the event of a major crisis or conflict with the United States.

“This is something we have been addressing for a long time,” said Rob Joyce, NSA’s Director of Cybersecurity and Deputy National Manager for National Security Systems (NSS). “Our insights on PRC pre-positioning have driven action across the cyber community. We have gotten better at all aspects of this, from understanding Volt Typhoon’s scope, to identifying the compromises likely to impact critical infrastructure systems, to hardening targets against these intrusions, to working together with partner agencies to combat PRC cyber actors.”

The CSA notes Volt Typhoon’s choice of targets and pattern of behavior are not consistent with traditional cyber espionage or intelligence gathering. Their ability to access operational technology (OT)could allow the group to disrupt OT functions across multiple critical infrastructure entities.

Read the full report here.

Source: NSA

IC News delivers the situational awareness you need to get ahead and stay ahead in the IC contracting space. Subscribe today for full access to 10,000+ articles, plus new articles each weekday.

The post NSA and partners issue Volt Typhoon advisory appeared first on Intelligence Community News.

In the role, Ray will work with the development team on the exoINSIGHT platform, expand the portfolio of analysis and data solutions, and contribute to Exovera’s cutting-edge technology, analysis, and data solutions for Great Power Competition (GPC).

“We are incredibly thrilled to have Jonathan Ray join our team,” said Jeff Zimmerman, Exovera chief operating officer. “Jonathan’s expertise and GPC community voice will be bring tremendous insights to further expanding the data, analytics, and technology powering our exoINSIGHT platform.”

Ray brings more than a decade of experience leading analysis, software, and data solutions for government and commercial organizations. Most recently he served as the director for security and foreign affairs at the U.S.-China Economic and Security Review Commission, an independent agency created by Congress to monitor and investigate the national security implications of the economic relationship between the U.S. and China. He oversaw analysis of China’s military, diplomatic, and influence activities around the world, and briefed the Commission’s findings and policy recommendations on Capitol Hill.

Prior to his work with the Commission, Ray held roles leading analysis and investigations for Exovera’s Center for Intelligence Research and Analysis (CIRA), the National Defense University, the Naval Postgraduate School, the Center for Nonproliferation Studies, and a commercial due diligence firm. He has published works on China’s pursuit of advanced technologies, including artificial intelligence, quantum computing, and robotics, as well as the country’s nuclear, space, cyber, and naval capabilities.

Source: Exovera

Keep up with your competitors by following notable executive moves across the IC contracting space — become a paid subscriber to IC News.

The post Jonathan Ray joins Exovera as director of open source appeared first on Intelligence Community News.

BlackTech, also known as Palmerworm, Temp. Overboard, Circuit Panda, and Radio Panda, has targeted government, industrial, technology, media, electronics, and telecommunication sectors. As a multinational threat linked to the People’s Republic of China (PRC), the actors have demonstrated capabilities in modifying router firmware without detection.

The CSA details tactics, techniques, and procedures (TTPs) used by BlackTech actors to compromise international subsidiaries, as well as recommended detection and mitigation techniques to defend against this threat. The CSA also highlights the need for multinational corporations to review all subsidiary connections, verify access, and consider implementing zero trust models to limit the extent of a potential compromise.

“Cyber actors look for the easiest way into their targeted network, like a thief checking vehicles for unlocked doors,” said Rob Joyce, NSA Cybersecurity Director. “Raising awareness of this malicious activities helps with not only hardening our defenses, but also those of our international allies, critical infrastructure, and private sector organizations.  We need to keep these actors out of our networks.”

As indicated in the CSA, the BlackTech actors target network routers typically used at remote branch offices to connect to corporate networks. The actors have compromised several Cisco routers using variations of TTPs to conceal configuration changes, hide commands, disable logging, and pivot between international subsidiaries’ and domestic headquarters’ networks.

Some of the TTPs mentioned in the CSA and used by this actor group include modifying router firmware to establish backdoors and persistence, pivoting using internal routers, and living off the land tactics to blend in with normal operating system and network activities to evade endpoint detection and response (EDR) products. BlackTech has also used a range of custom malware to target Windows, Linux, and FreeBSD operating systems.

“Subsidiaries of multinational corporations are attractive targets for threat actors,” said Joyce. “The security of these subsidiaries’ IT environments are sometimes overlooked, posing a significant risk for the critical systems of their international partners. We need to continue to be vigilant and work together across international industry and government to effectively implement best practices to secure vital IT environments.”

The authoring agencies recommend implementing the mitigations in the CSA to detect malicious activities and protect devices from being compromised by BlackTech actors.

For additional information and examples of similar actors and activities, see “People’s Republic of China State-Sponsored Cyber Actors Exploit Network Providers and Devices” and “People’s Republic of China State-Sponsored Cyber Actors Living off the Land to Evade Detection.”

Source: NSA

If you enjoyed this article, please consider becoming a paid subscriber. Your support helps keep our site ad-free.

The post US and Japanese agencies issue BlackTech advisory appeared first on Intelligence Community News.

The COVID-19 Origin Act of 2023 required the Intelligence Community to declassify information relating to potential links between the Wuhan Institute of Virology and the origin of the COVID-19 pandemic.

ODNI submitted the report to Congress, and it can be viewed here.

Source: ODNI

If you enjoyed this article, please consider becoming a paid subscriber. Your support helps keep our site ad-free.

The post ODNI releases report on COVID-19 “lab leak” theory appeared first on Intelligence Community News.