Nation-state hacker group targeting Taiwan, US, Vietnam and Pacific Islands
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2019-0803 | Local Privilege Escalation in Microsoft Win32k Kernel Component CVE-2019-0803 is a privilege escalation flaw in Microsoft's Win32k kernel component caused by improper handling of objects in memory. It is triggered locally when code already running on a Windows system reaches the vulnerable Win32k object-handling path, allowing memory corruption that the attacker can leverage. Successful exploitation lets the attacker run arbitrary code in kernel mode, elevating from a low-privileged account to full system-level control. Per the available data, the affected component is Microsoft Win32k across Windows installations, though specific affected Windows versions and builds are not enumerated in the source data and should be confirmed against Microsoft's advisory. Exploitation is confirmed in the wild: CISA added it to the KEV catalog on 2021-11-03 with known ransomware use, and EPSS assigns a 45.2% probability of exploitation within 30 days (99th percentile). Do: Apply Microsoft Windows security updates per vendor instructions — this flaw was fixed in Microsoft's April 2019 security updates, so ensure systems are running those or later cumulative updates and verify by checking OS build numbers. Prioritize patching endpoints and servers where untrusted or low-privileged users can execute code, given documented ransomware chaining. Treat KEV status as a deadline: systems unpatched for this Win32k flaw should be considered actively targeted. | 7.8 | 45% | KEV ransomware |
| masshundreds of millions of Windows desktops and servers (Win32k is a core component shipped with essentially all Windows installations) |
Full article488 words · extracted from therecord.media · click to collapse
A previously unknown government-backed hacking group is targeting organizations in the manufacturing, IT, and biomedical sectors across Taiwan, Vietnam, the U.S. and an unnamed Pacific island, according to new research from Symantec. The researchers are tracking the group under the name “Grayling” and said in a report released Tuesday that it is using custom-made malware as well as publicly available tools to attack its targets. The attacks, which began in February and continued through May, stood out to researchers due to the use of distinctive hacking tools. The goal of the campaign is espionage rather than financial motives, they said. They found attacks on several organizations in the manufacturing, IT, and biomedical sectors in Taiwan as well as an incident involving a government agency located in the pacific island. Unnamed organizations in Vietnam and the U.S. were also targeted as part of the campaign. “There are indications that Grayling may exploit public facing infrastructure for initial access to victim machines,” Symantec said. “The attackers take various actions once they gain initial access to victims’ computers, including escalating privileges, network scanning, and using downloaders.” The hackers used Havoc, an open-source tool that has gained prominence among hackers as an alternative to Cobalt Strike. The tool allows hackers to download additional payloads, execute commands on victim machines, manipulate Windows tokens and more. During the attacks, Symantec saw the hackers use a spyware tool called NetSpy and exploit a popular Windows vulnerability, tracked as CVE-2019-0803. “While we do not see data being exfiltrated from victim machines, the activity we do see and the tools deployed point to the motivation behind this activity being intelligence gathering. The sectors the victims operate in…are also sectors that are most likely to be targeted for intelligence gathering rather than for financial reasons,” they said. “The use of custom techniques combined with publicly available tools is typical of the activity we see from APT groups these days, with threat actors often using publicly available or living-off-the-land tools in attempts to bypass security software and help their activity stay under the radar of defenders.” While Symantec declined to attribute the activity to a specific country, they said the “heavy targeting of Taiwanese organizations does indicate that they likely operate from a region with a strategic interest in Taiwan.” In May, the U.S. government and Microsoft accused Chinese hackers of infiltrating critical infrastructure systems and other areas around U.S. military bases in Guam, a U.S. territory in the Pacific. Symantec has also released multiple reports this year tracking Chinese espionage campaigns across Vietnam and other Southeast Asian nations, as well as Taiwan.
No previous article
No new articles
Jonathan Greig
is a Breaking News Reporter at Recorded Future News. Jonathan has worked across the globe as a journalist since 2014. Before moving back to New York City, he worked for news outlets in South Africa, Jordan and Cambodia. He previously covered cybersecurity at ZDNet and TechRepublic.
Text extracted automatically; images, tables and formatting may be missing. Original: https://therecord.media/nation-state-apt-targeting-taiwan-us