Malwarecritical
Chinese Hackers Target Taiwan's Semiconductor Sector with Cobalt Strike, Custom Backdoors
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2018-0171 | Unauthenticated RCE/DoS in Cisco IOS & IOS XE Smart Install | 9.8 | 99% | KEV | KEV |
| CVE-2023-20198 | Unauthenticated Privilege Escalation in Cisco IOS XE Web UI (Actively Exploited) | 10.0 | 100% | KEV | KEV |
| CVE-2023-20273 | Authenticated Command Injection (Root) in Cisco IOS XE Web UI | 7.2 | 93% | KEV | KEV |
| CVE-2024-3400 | Unauthenticated Root Command Injection in Palo Alto Networks PAN-OS GlobalProtect | 10.0 | 100% | KEVRansomwarePoC ×2 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | accshieldportal.com | d a link to the actor-controlled credential phishing domain accshieldportal[.]com, as well as a tracking beacon URL for acesportal[.]com," |
| domain | acesportal.com | accshieldportal[.]com, as well as a tracking beacon URL for acesportal[.]com," Proofpoint said, adding the threat actor had previously |
| domain | moctw.info | t Assistant (EMA) for remote control via the C2 domain "ema.moctw[.]info." "This UNK_DropPitch targeting is exemplary of intellige |
| ipv4 | 45.141.139.222 | hat establishes contact with an actor-controlled VPS server 45.141.139[.]222 over TCP port 465. The reverse shell serves as a pathway |
From the original article
6 min read at thehackernews.com
The Taiwanese semiconductor industry has become the target of spear-phishing campaigns undertaken by three previously undocumented Chinese state-sponsored threat actors.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.