Nation-state group CL-STA-0969 targeted Southeast Asian telecoms in 2024
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2016-5195 | Dirty COW Race Condition Enables Local Privilege Escalation in the Linux Kernel CVE-2016-5195, widely known as 'Dirty COW', is a race condition (CWE-362) in the copy-on-write (COW) memory-handling code in mm/gup.c of the Linux kernel, affecting kernel versions 2.x through 4.x before 4.8.3. A local user with low privileges can trigger the race — including via the PTRACE_POKEDATA path used in public exploits — to write to a read-only memory mapping that should not be writable, corrupting files or overwriting memory. This yields root-level privileges on the host, enabling full system takeover, malware implantation and persistence. Any system running an affected kernel is exposed, spanning Ubuntu, Red Hat Enterprise Linux (including AUS, EUS, Long Life and TUS variants), Debian, Fedora, Palo Alto Networks PAN-OS, and NetApp Cloud Backup and HCI Storage Nodes that ship an affected kernel. Exploitation is confirmed in the wild: the flaw was actively exploited in October 2016, including by the first Android malware found using it to gain root, it was added to CISA's KEV catalog on 2022-03-03 with the required action to apply vendor updates, and EPSS currently assigns an 83.5% probability of exploitation in the next 30 days (100th percentile). Do: Upgrade to Linux kernel 4.8.3 or later, or apply the vendor-issued patched/backported kernel updates from Canonical, Red Hat, Debian, Fedora Project, Palo Alto Networks (PAN-OS) and NetApp, per the CISA KEV required action. Prioritize unpatched legacy servers and internet-exposed Linux hosts — especially multi-user systems, SSH-accessible machines and containers where untrusted users can run code — and update Android devices that may have been silently rooted via Dirty COW. Until patching completes, restrict local and SSH access to trusted users, since exploitation requires local low-privileged code execution. | 7.0 | 84% | KEV PoC ×5 |
| mass≈ hundreds of millions of Linux systems and devices (affected kernels shipped in nearly all mainstream distributions, appliances and Android devices of the… | |
| CVE-2021-3156 | Heap-Based Buffer Overflow in Sudo Enables Local Privilege Escalation (CVE-2021-3156) CVE-2021-3156 is an off-by-one error (CWE-193) in the Unix Sudo utility that causes a heap-based buffer overflow (CWE-122) in Sudo's handling of command-line arguments. It is triggered locally when an unprivileged user invokes Sudo with specially crafted arguments, requiring no special privileges or non-default configuration. A successful exploit allows the attacker to execute arbitrary code as root, achieving full local privilege escalation on the host. Any Linux, Unix, or other system running a vulnerable version of Sudo is affected, and because Sudo ships by default on virtually all such systems the potential footprint is enormous. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog (added 2022-04-06) and carries a 100% EPSS probability of exploitation within 30 days, indicating active in-the-wild exploitation, though specific ransomware use is unknown. Do: Upgrade Sudo to a patched release (1.9.5p2 or later, or the vendor-supplied update for your distribution) per vendor instructions, as required by the CISA KEV listing. Audit all Unix-like hosts by checking the installed Sudo version through your package manager and prioritize patching multi-user and internet-facing servers. Restricting local shell access and monitoring for anomalous Sudo invocations can reduce risk while patching completes. | 7.8 | 100% | KEV PoC ×12 |
| masstens of millions of Linux/Unix servers, workstations and devices (Sudo is preinstalled on virtually all Linux distributions) | |
| CVE-2021-4034 | Out-of-Bounds Read/Write Local Privilege Escalation in polkit pkexec (PwnKit) CVE-2021-4034 ('PwnKit') is an out-of-bounds read and write (CWE-125/CWE-787) in polkit's setuid-root pkexec utility, which mishandles the calling parameter count and ends up trying to execute environment variables as commands. A local attacker who runs pkexec with crafted environment variables can induce it to execute arbitrary code, gaining administrative (root) rights on the target machine. Because polkit is installed by default on mainstream Linux distributions — including Red Hat Enterprise Linux and its many variants, with the flaw also tracked against Canonical, SUSE, Oracle, Siemens, and StarWind Software products — essentially every standard Linux installation was exposed. The flaw is being actively exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2022-06-27 with known ransomware use, and EPSS assigns a 94.9% probability of exploitation (100th percentile). Public proof-of-concept exploits are widely available, making exploitation trivial for any user with local access to an unpatched host. Do: Apply the polkit/pkexec updates from each distribution vendor immediately per vendor instructions, as required by the CISA KEV catalog. If patching must be delayed, removing the setuid bit from pkexec (e.g., chmod 0755 /usr/bin/pkexec) is a widely documented interim mitigation, though it may affect functionality that relies on pkexec. Prioritize hosts where untrusted or low-privilege users can log in, and hunt for prior exploitation given known ransomware use. | 7.8 | 95% | KEV ransomware PoC ×4 |
| masstens of millions of Linux servers and workstations (polkit/pkexec ships by default on virtually all mainstream distributions) |
Full article648 words · extracted from securityaffairs.com · click to collapse
State-backed group CL-STA-0969 hit Southeast Asian telecoms in 2024, targeting critical infrastructure, says Palo Alto Networks’ Unit 42.
Palo Alto Networks reported that a nation-state actor, tracked as CL-STA-0969, targeted telecom firms in Southeast Asia, with attacks on critical infrastructure from February to November 2024.
Threat actor CL-STA-0969 overlaps with the China-linked cyber espionage group Liminal Panda. The threat actor also showed overlap with groups like Light Basin, UNC3886, UNC2891, and UNC1945, using a mix of custom and public tools such as Microsocks, FRP, FScan, and Responder, as well as exploits for known vulnerabilities like CVE-2016-5195, CVE-2021-4034, and CVE-2021-3156. The group maintained strong OPSEC, staying undetected through DNS tunneling, routing via compromised mobile networks, log clearing, and disguising process names.
The researchers haven’t found evidence of data exfiltration, they used tools like Cordscan in an attempt to collect mobile device location data. The group sets up resilient remote access, likely for future espionage operations.
Between February and November 2024, the APT group targeted critical telecommunications infrastructure, likely gaining access through brute-force attacks on authentication systems. Using custom tools like AuthDoor, GTPDoor, ChronosRAT, and NoDepDNS, they exploited telecom protocols such as SSH, ICMP, DNS, and GTP for covert access and command-and-control. To maintain stealth, they used PAM backdoors, disguised processes, tampered with logs, and disabled SELinux, demonstrating deep knowledge of telecom environments and strong operational security.
“Despite their high level of OPSEC, substantial evidence points to attackers gaining initial access via SSH brute force. To do this, they used a well-tuned account dictionary list that included built-in accounts specific to telecommunications equipment.” reads the report published by Palo Alto Networks.
Below is the list of tools used by threat actor CL-STA-0969:
- AuthDoor: A PAM backdoor that captures user credentials by hooking into authentication functions. It supports hardcoded password access, updates stolen credentials in a hidden log, and can execute files from a specific directory for persistent access.
- Cordscan: A network scanning and packet capture tool tailored for telecom environments. It targets SGSN nodes to extract IMSI and operator data. It crafts and sends GTP packets to scan for specific mobile subscribers, logging results in a
.pcapfile. - GTPDoor: A Linux implant that uses GTP-C signaling (UDP port 2123) to tunnel C2 traffic within telecom networks, supporting beaconing and remote code execution. It bypasses traditional detection tools due to its use of telecom-specific protocols.
- EchoBackdoor: A passive ICMP-based backdoor that listens for encrypted instructions in echo request packets. It reconstructs and executes commands and replies via ICMP echo replies, avoiding outbound connections and making detection harder.
- SGSN Emulator: Emulates an SGSN node using the OsmoGGSN project to create tunnels to mobile operators via GRX. It connects with IMSI/MSISDN pairs and sets up a SOCKS proxy for data exfiltration, routing traffic through tun interfaces.
- ChronosRAT: A modular Linux RAT that ensures persistence via a watchdog process. It includes AES-encrypted TCP C2, dynamic RSA key updates, and modules for remote shell, keylogging, screenshots, port forwarding, file management, and SOCKS proxy.
- NoDepDNS: A stealthy Go-based backdoor using DNS tunneling over port 53. It decodes commands embedded in DNS response IP addresses using XOR encryption and executes them, but does not return output. Monitored and maintained by shell scripts.
“CL-STA-0969 demonstrates a deep understanding of telecommunications protocols and infrastructure. Its malware, tools and techniques reveal a calculated effort to maintain persistent, stealthy access. It achieved this by proxying traffic through other telecom nodes, tunneling data using less-scrutinized protocols and employing various defense evasion techniques. Organizations relying on legacy hosts and services within the targeted infrastructure increases vulnerability to such attacks.” conludes the report.
“CL-STA-0969’s multi-pronged operational strategy, combining technical expertise with environmental adaptation, underscores the need for vigilant security measures and proactive threat intelligence.”
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, CL-STA-0969)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/180737/apt/nation-state-group-cl-sta-0969-targeted-southeast-asian-telecoms-in-2024.html