Chinese hackers use Log4j exploit to go after academic institution

The attack is the latest strike by Chinese hackers using Log4j.

A Chinese hacking group known for industrial espionage and intelligence collection used a vulnerability in Log4j to go after a large academic institution, researchers at CrowdStrike revealed Wednesday.

Threat analysts observed the group attempting to install malware after gaining access using a modified version of a Log4j exploit for VMWare Horizon, a virtual workspace technology. CrowdStrike also observed the Chinese hackers trying to harvest credentials for further exploitation.

CrowdStrike analysts believe that the group behind the attack, which it is calling “Aquatic Panda,” has likely been active since at least May 2020. Its operations have primarily focused on targets in the telecommunications, technology and government sectors.

“Because OverWatch disrupted the attack before AQUATIC PANDA could take action on their objectives, their exact intent is unknown,” Param Singh, vice president of CrowdStrike OverWatch, wrote to CyberScoop in an email. “This adversary, however, is known to use tools to maintain persistence in environments so they can gain access to intellectual property and other industrial trade secrets.”

CrowdStrike didn’t name the institution that Aquatic Panda targeted, or its location.

Researchers at Mandiant and Microsoft have also reported activity by Chinese threat groups exploiting the Log4j vulnerability. Microsoft observed attacks by the Chinese group, “HAFNIUM,” using the vulnerability against virtualization infrastructure. Microsoft also warned of attacks using the vulnerability by groups tied to Iran, North Korea and Turkey.

Log4j is an open-source software tool ubiquitous across the tech industry and can be found in millions of systems, making the full scope of potential victims hard to track. Cybercriminals raced to take advantage of the vulnerability when it was revealed earlier this month, meaning that even if organizations have patched their systems attackers could have already established a foothold.

The Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency on Dec. 22 issued an advisory on how to deal with potential risks to IT and cloud services that the vulnerability poses.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure