Suspected Chinese hackers took advantage of Microsoft Exchange vulnerability to steal call records

Chinese hackers are still swiping call records.

Hackers with ties to China took advantage of vulnerabilities in Microsoft Exchange for several months starting in late 2020 to steal call logs from a Southeast Asia telecommunication company, researchers at Cybereason report.

The White House last month formally blamed Chinese government-affiliated hacking group HALFNIUM for a massive hacking campaign exploiting vulnerabilities in Microsoft Exchange servers, a kind of mail technology. Cybereason found that the groups targeting the unnamed Southeast Asian telecom had access to the same vulnerability for months prior to Microsoft’s disclosure.

The new findings build on a 2019 report from Cybereason, in which investigators identified a long-running hacking campaign that breached about 10 cellular providers in Africa, Europe, the Middle East, and Asia. Now researchers can say that not only has that group not let up, but that they are now also joined by two more groups tied to Chinese intelligence conducting the same kinds of operations.

The three clusters of activity detailed in the report had evaded detection since at least 2017, according to the research. Given the focus on the same target and the overlap in tactics, it appears likely that all three groups were working in the interest of the Chinese government, says Assaf Dahan, head of threat research at Cybereason.

Dahan says it’s likely that the hackers accessed hundreds of gigabytes, if not terabytes, of data from the cellular provider. That could amount to hundreds of thousands of call records. Most likely, however, the hackers sought a handful of select targets of interest to the Chinese government, such as political dissidents.

While there are a number of ways for foreign governments to conduct espionage against individuals, such as using spyware directly on a target’s phone, going straight after the telecom providers can make the activity harder to detect, says Dahan.

“It will be very difficult to understand who were the actual targets because it’s not like they’re attacking the end-users,” says Dahan. “They’re attacking the provider. It makes attribution harder.”

While the hackers have primarily targeted Asian telecom providers, the attacks could be recreated against providers in other regions, Dahan notes.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Dogged Russia-based botnet dismantled after 23-year run

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure