RedJuliett Cyber Espionage Campaign Hits 75 Taiwanese Organizations
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2016-5195 | Dirty COW Race Condition Enables Local Privilege Escalation in the Linux Kernel CVE-2016-5195, widely known as 'Dirty COW', is a race condition (CWE-362) in the copy-on-write (COW) memory-handling code in mm/gup.c of the Linux kernel, affecting kernel versions 2.x through 4.x before 4.8.3. A local user with low privileges can trigger the race — including via the PTRACE_POKEDATA path used in public exploits — to write to a read-only memory mapping that should not be writable, corrupting files or overwriting memory. This yields root-level privileges on the host, enabling full system takeover, malware implantation and persistence. Any system running an affected kernel is exposed, spanning Ubuntu, Red Hat Enterprise Linux (including AUS, EUS, Long Life and TUS variants), Debian, Fedora, Palo Alto Networks PAN-OS, and NetApp Cloud Backup and HCI Storage Nodes that ship an affected kernel. Exploitation is confirmed in the wild: the flaw was actively exploited in October 2016, including by the first Android malware found using it to gain root, it was added to CISA's KEV catalog on 2022-03-03 with the required action to apply vendor updates, and EPSS currently assigns an 83.5% probability of exploitation in the next 30 days (100th percentile). Do: Upgrade to Linux kernel 4.8.3 or later, or apply the vendor-issued patched/backported kernel updates from Canonical, Red Hat, Debian, Fedora Project, Palo Alto Networks (PAN-OS) and NetApp, per the CISA KEV required action. Prioritize unpatched legacy servers and internet-exposed Linux hosts — especially multi-user systems, SSH-accessible machines and containers where untrusted users can run code — and update Android devices that may have been silently rooted via Dirty COW. Until patching completes, restrict local and SSH access to trusted users, since exploitation requires local low-privileged code execution. | 7.0 | 84% | KEV PoC ×5 |
| mass≈ hundreds of millions of Linux systems and devices (affected kernels shipped in nearly all mainstream distributions, appliances and Android devices of the… |
Full article434 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananJun 24, 2024Cyber Espionage / Hacking
A likely China-linked state-sponsored threat actor has been linked to a cyber espionage campaign targeting government, academic, technology, and diplomatic organizations in Taiwan between November 2023 and April 2024.
Recorded Future's Insikt Group is tracking the activity under the name RedJuliett, describing it as a cluster that operates from Fuzhou, China, to support Beijing's intelligence collection goals related to the East Asian country. It's also tracked under the names Flax Typhoon and Ethereal Panda.
Among other countries targeted by the adversarial collective include Djibouti, Hong Kong, Kenya, Laos, Malaysia, the Philippines, Rwanda, South Korea, and the U.S.
In all, as many as 24 victim organizations have been observed communicating with the threat actor infrastructure, including government agencies in Taiwan, Laos, Kenya, and Rwanda. It's also estimated to have targeted at least 75 Taiwanese entities for broader reconnaissance and follow-on exploitation.
"The group targets internet-facing appliances such as firewalls, load balancers, and enterprise virtual private network VPN products for initial access, as well as attempting structured query language SQL injection and directory traversal exploits against web and SQL applications," the company said in a new report published today.
As previously documented by CrowdStrike and Microsoft, RedJuliett is known to employ the open-source software SoftEther to tunnel malicious traffic out of victim networks and leverage living-off-the-land (LotL) techniques to fly under the radar. The group is believed to be active since at least mid-2021.
"Additionally, RedJuliett used SoftEther to administer operational infrastructure consisting of both threat actor-controlled servers leased from virtual private server VPS providers and compromised infrastructure belonging to three Taiwanese universities," Recorded Future noted.
A successful initial access is followed by the deployment of the China Chopper web shell to maintain persistence, alongside other open-source web shells like devilzShell, AntSword, and Godzilla. A few instances have also entailed the exploitation of a Linux privilege escalation vulnerability known as Dirty Cow (CVE-2016-5195).
"RedJuliett is likely interested in collecting intelligence on Taiwan’s economic policy and trade and diplomatic relations with other countries," it said.
"RedJuliett, like many other Chinese threat actors, is likely targeting vulnerabilities in internet-facing devices because these devices have limited visibility and security solutions available, and targeting them has proven to be an effective way to scale initial access."
Update
In a statement released by China's Ministry of Foreign Affairs, spokesperson Mao Ning dismissed the allegations, describing them as "fabricated disinformation on so-called Chinese hacking operations."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2024/06/redjuliett-cyber-espionage-campaign.html