NSA warns defense contractors of recent Chinese government

Chinese hackers are using known vulnerabilities to breach a multitude of victims.

U.S. defense contractors should be wary of Chinese government-backed hackers who are actively exploiting a multitude of known vulnerabilities to target — and successfully breach — victim networks, the National Security Agency said in an advisory Tuesday.

The hackers are specifically going after 25 known vulnerabilities that primarily affect products used for remote access or for external web services, which the NSA lays out in detail in the advisory. Vulnerabilities the Chinese hackers are exploiting include those of Pulse Secure VPNs, which could allow attackers to steal victim passwords, as well as F5 Networks’ Big-IP Traffic Management User Interface, Windows Domain Name System servers, a series of flaws in Citrix ADC and Gateway devices, and several others.

System administrators in the defense industrial base should immediately patch the vulnerabilities the Chinese hackers are exploiting, the NSA warned.

“NSA is aware that National Security Systems, Defense Industrial Base, and Department of Defense networks are consistently scanned, targeted, and exploited by Chinese state-sponsored cyber actors,” the NSA said in its release. “NSA recommends that critical system owners consider these actions a priority, in order to mitigate the loss of sensitive information that could impact U.S. policies, strategies, plans, and competitive advantage.”

All of the vulnerabilities the NSA highlights in its release have been previously identified — but the NSA hopes that by explicitly linking them with Chinese hacking operations, defense contractors pay more attention to patching them for fear of becoming collateral damage in espionage campaigns.

“We hear loud and clear that it can be hard to prioritize patching and mitigation efforts,” Anne Neuberger, the director of the NSA Cybersecurity Directorate, said in a statement. “We hope that by highlighting the vulnerabilities that China is actively using to compromise systems, cybersecurity professionals will gain actionable information to prioritize efforts and secure their systems.”

While system administrators in the defense sector should pay attention to the NSA warning, cybersecurity practitioners in other sectors should pay attention as well, according to the NSA. Chinese state-sponsored actors have used some of the vulnerabilities the NSA listed to target entities in the telecommunications, healthcare, financial, transportation, petrochemical, and manufacturing sectors as well, according to FireEye research published in March.

Other agencies have also worked to raise awareness about Chinese state-sponsored hackers taking advantage of known flaws in recent months. The FBI and the Department of Homeland Security’s cybersecurity agency, the Cybersecurity and Infrastructure Security Agency, warned last month that hackers with ties to China’s civilian intelligence and counterintelligence service, the Ministry of State Security (MSS) have been using flaws in F5 Networks’ Big-IP Traffic Management User Interface, Citrix VPN Appliances, and Pulse Secure VPN appliances.

The NSA did not name the MSS in its advisory.

Russian hackers have also capitalized on some of the vulnerabilities named in the NSA advisory. APT29, a hacking group that has been tied to Russia’s Foreign Intelligence Service (SVR) or the country’s Federal Security Service (FSB), has used the Pulse Secure VPN vulnerability to target coronavirus research in recent months., according to the NSA. Iran-linked hackers have likewise used some of the vulnerabilities named in the NSA release, according to ClearSky researchers.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure