CL-STA-0969 Installs Covert Malware in Telecom Networks During 10
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2016-5195 | Dirty COW Race Condition Enables Local Privilege Escalation in the Linux Kernel CVE-2016-5195, widely known as 'Dirty COW', is a race condition (CWE-362) in the copy-on-write (COW) memory-handling code in mm/gup.c of the Linux kernel, affecting kernel versions 2.x through 4.x before 4.8.3. A local user with low privileges can trigger the race — including via the PTRACE_POKEDATA path used in public exploits — to write to a read-only memory mapping that should not be writable, corrupting files or overwriting memory. This yields root-level privileges on the host, enabling full system takeover, malware implantation and persistence. Any system running an affected kernel is exposed, spanning Ubuntu, Red Hat Enterprise Linux (including AUS, EUS, Long Life and TUS variants), Debian, Fedora, Palo Alto Networks PAN-OS, and NetApp Cloud Backup and HCI Storage Nodes that ship an affected kernel. Exploitation is confirmed in the wild: the flaw was actively exploited in October 2016, including by the first Android malware found using it to gain root, it was added to CISA's KEV catalog on 2022-03-03 with the required action to apply vendor updates, and EPSS currently assigns an 83.5% probability of exploitation in the next 30 days (100th percentile). Do: Upgrade to Linux kernel 4.8.3 or later, or apply the vendor-issued patched/backported kernel updates from Canonical, Red Hat, Debian, Fedora Project, Palo Alto Networks (PAN-OS) and NetApp, per the CISA KEV required action. Prioritize unpatched legacy servers and internet-exposed Linux hosts — especially multi-user systems, SSH-accessible machines and containers where untrusted users can run code — and update Android devices that may have been silently rooted via Dirty COW. Until patching completes, restrict local and SSH access to trusted users, since exploitation requires local low-privileged code execution. | 7.0 | 84% | KEV PoC ×5 |
| mass≈ hundreds of millions of Linux systems and devices (affected kernels shipped in nearly all mainstream distributions, appliances and Android devices of the… | |
| CVE-2021-3156 | Heap-Based Buffer Overflow in Sudo Enables Local Privilege Escalation (CVE-2021-3156) CVE-2021-3156 is an off-by-one error (CWE-193) in the Unix Sudo utility that causes a heap-based buffer overflow (CWE-122) in Sudo's handling of command-line arguments. It is triggered locally when an unprivileged user invokes Sudo with specially crafted arguments, requiring no special privileges or non-default configuration. A successful exploit allows the attacker to execute arbitrary code as root, achieving full local privilege escalation on the host. Any Linux, Unix, or other system running a vulnerable version of Sudo is affected, and because Sudo ships by default on virtually all such systems the potential footprint is enormous. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog (added 2022-04-06) and carries a 100% EPSS probability of exploitation within 30 days, indicating active in-the-wild exploitation, though specific ransomware use is unknown. Do: Upgrade Sudo to a patched release (1.9.5p2 or later, or the vendor-supplied update for your distribution) per vendor instructions, as required by the CISA KEV listing. Audit all Unix-like hosts by checking the installed Sudo version through your package manager and prioritize patching multi-user and internet-facing servers. Restricting local shell access and monitoring for anomalous Sudo invocations can reduce risk while patching completes. | 7.8 | 100% | KEV PoC ×12 |
| masstens of millions of Linux/Unix servers, workstations and devices (Sudo is preinstalled on virtually all Linux distributions) | |
| CVE-2021-4034 | Out-of-Bounds Read/Write Local Privilege Escalation in polkit pkexec (PwnKit) CVE-2021-4034 ('PwnKit') is an out-of-bounds read and write (CWE-125/CWE-787) in polkit's setuid-root pkexec utility, which mishandles the calling parameter count and ends up trying to execute environment variables as commands. A local attacker who runs pkexec with crafted environment variables can induce it to execute arbitrary code, gaining administrative (root) rights on the target machine. Because polkit is installed by default on mainstream Linux distributions — including Red Hat Enterprise Linux and its many variants, with the flaw also tracked against Canonical, SUSE, Oracle, Siemens, and StarWind Software products — essentially every standard Linux installation was exposed. The flaw is being actively exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2022-06-27 with known ransomware use, and EPSS assigns a 94.9% probability of exploitation (100th percentile). Public proof-of-concept exploits are widely available, making exploitation trivial for any user with local access to an unpatched host. Do: Apply the polkit/pkexec updates from each distribution vendor immediately per vendor instructions, as required by the CISA KEV catalog. If patching must be delayed, removing the setuid bit from pkexec (e.g., chmod 0755 /usr/bin/pkexec) is a widely documented interim mitigation, though it may affect functionality that relies on pkexec. Prioritize hosts where untrusted or low-privilege users can log in, and hunt for prior exploitation given known ransomware use. | 7.8 | 95% | KEV ransomware PoC ×4 |
| masstens of millions of Linux servers and workstations (polkit/pkexec ships by default on virtually all mainstream distributions) |
Full article922 words · extracted from thehackernews.com · click to collapse
Telecommunications organizations in Southeast Asia have been targeted by a state-sponsored threat actor known as CL-STA-0969 to facilitate remote control over compromised networks.
Palo Alto Networks Unit 42 said it observed multiple incidents in the region, including one aimed at critical telecommunications infrastructure between February and November 2024.
The attacks are characterized by the use of several tools to enable remote access, as well as the deployment of Cordscan, which can collect location data from mobile devices.
However, the cybersecurity company said it found no evidence of data exfiltration from the networks and systems it investigated. Nor were any efforts made by the attackers to track or communicate with target devices within mobile networks.
"The threat actor behind CL-STA-0969 maintained high operational security (OPSEC) and employed various defense evasion techniques to avoid detection," security researchers Renzon Cruz, Nicolas Bareil, and Navin Thomas said.
CL-STA-0969, per Unit 42, shares significant overlaps with a cluster tracked by CrowdStrike under the name Liminal Panda, a China-nexus espionage group that has been attributed to attacks directed against telecommunications entities in South Asia and Africa since at least 2020 with the goal of intelligence gathering.
It's worth noting that some aspects of Liminal Panda's tradecraft were previously attributed to another threat actor called LightBasin (aka UNC1945), which has also singled out the telecom sector since 2016. LightBasin, for its part, overlaps with a third cluster dubbed UNC2891, a financially motivated crew known for its attacks on Automatic Teller Machine (ATM) infrastructure.
"While this cluster significantly overlaps with Liminal Panda, we have also observed overlaps in attacker tooling with other reported groups and activity clusters, including Light Basin, UNC3886, UNC2891, and UNC1945," the researchers pointed out.
In at least one case, CL-STA-0969 is believed to have employed brute-force attacks against SSH authentication mechanisms for initial compromise, leveraging the access to drop various implants such as -
- AuthDoor, a malicious Pluggable Authentication Module (PAM) that works similar to SLAPSTICK (originally attributed to UNC1945) to conduct credential theft and provide persistent access to the compromised host via a hard-coded magic password
- Cordscan, a network scanning and packet capture utility (previously attributed to Liminal Panda)
- GTPDOOR, a malware explicitly designed to be deployed in telecom networks that are adjacent to GPRS roaming exchanges
- EchoBackdoor, a passive backdoor that listens for ICMP echo request packets containing command-and-control (C2) instructions to extract the command and send the results of the execution back to the server via an unencrypted ICMP Echo Reply packet
- Serving GPRS Support Node (SGSN) Emulator (sgsnemu), an emulation software to tunnel traffic via the telecommunications network and bypass firewall restrictions (previously attributed to Liminal Panda)
- ChronosRAT, a modular ELF binary that's capable of shellcode execution, file operations, keylogging, port forwarding, remote shell, screenshot capture, and proxy capabilities
- NoDepDNS (internally referred to as MyDns), a Golang backdoor that creates a raw socket and passively listens for UDP traffic on port 53 to parse incoming commands via DNS messages
"CL-STA-0969 leveraged different shell scripts that established a reverse SSH tunnel along with other functionalities," Unit 42 researchers noted. "CL-STA-0969 systematically clears logs and deletes executables when they are no longer needed, to maintain a high degree of OPSEC."
Adding to the already broad portfolio of malicious tools that the threat actor has deployed are Microsocks proxy, Fast Reverse Proxy (FRP), FScan, Responder, and ProxyChains, as well as programs to exploit flaws in Linux and UNIX-based systems (CVE-2016-5195, CVE-2021-4034, and CVE-2021-3156) to achieve privilege escalation.
Besides using a combination of bespoke and publicly available tooling, the threat actors have been found to adopt a number of strategies to fly under the radar. This encompasses DNS tunneling of traffic, routing traffic through compromised mobile operators, erasing authentication logs, disabling Security-Enhanced Linux (SELinux), and disguising process names with convincing names that match the target environment.
"CL-STA-0969 demonstrates a deep understanding of telecommunications protocols and infrastructure," Unit 42 said. "Its malware, tools and techniques reveal a calculated effort to maintain persistent, stealthy access. It achieved this by proxying traffic through other telecom nodes, tunneling data using less-scrutinized protocols and employing various defense evasion techniques."
China Accuses U.S. Agencies of Targeting Military and Research Institutions
The disclosure comes as the National Computer Network Emergency Response Technical Team/Coordination Center of China (CNCERT) accused U.S. intelligence agencies of weaponizing a Microsoft Exchange zero-day exploit to steal defense-related information and hijack more than 50 devices belonging to a "major Chinese military enterprise" between July 2022 and July 2023.
The agency also said high-tech military-related universities, scientific research institutes, and enterprises in the country were targeted as part of these attacks to siphon valuable data from compromised hosts. Among those targeted was a Chinese military enterprise in the communications and satellite internet sectors that was attacked from July to November of 2024 by exploiting vulnerabilities in electronic file systems, CNCERT alleged.
The attribution effort mirrors tactics from the West, which has repeatedly blamed China for major cyber attacks, counting the latest zero-day exploitation of Microsoft SharePoint Server vulnerabilities.
Asked last month about Chinese hacking into U.S. telecom systems and theft of intellectual property on Fox News, U.S. President Donald Trump said, "You don't think we do that to them? We do. We do a lot of things. That's the way the world works. It's a nasty world."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2025/08/cl-sta-0969-installs-covert-malware-in.html