Chinese hackers target state governments

GettyImages/d3sign

By Susan Miller,
Deputy Editor, Route Fifty

Connecting state and local government leaders

By Susan Miller

| March 10, 2022

The APT41 group known to be linked to the Chinese government took advantage of vulnerable internet-facing applications to target at least six state government networks, according to a threat intelligence firm.

At least six state governments have been targeted by the APT41 group known to be linked to the Chinese government.

According to a March 8 report by Mandiant, the attackers took advantage of vulnerable internet-facing applications to target at least six state government networks through a combination SQL injection and the Log4J remote code execution between May 2021 and February 2022.

Even though the activity was detected and contained, the attackers re-compromised networks through a previously unknown zero-day vulnerability in Acclaim Systems' USAHerds application, a commercial web-based product used by 18 states to manage animal health, according to a Mandiant. Acclaim issued a patch in mid-November.

Other exploits by APT41 against state governments are detailed in the report, which says that the threat group's latest tradecraft and malware shows it is adaptable and resourceful. For example, after gaining initial access to an internet-facing server, APT41 conducts extensive reconnaissance and credential harvesting. The group uses advanced malware with features that hinder analysis and investigations, and it “continues to leverage advanced tradecraft to remain persistent and undetected,” the company said.

While the goals of this campaign against state governments are yet unknown, Mandiant said it has observed evidence of the exfiltration of personal identifiable information.

"APT41's recent activity against U.S. state governments consists of significant new capabilities, from new attack vectors to post-compromise tools and techniques,” the report said. “APT41 exploiting Log4J in close proximity to the USAHerds campaign showed the group’s flexibility to continue targeting U.S state governments through both cultivated and co-opted attack vectors."

NEXT STORY: Cyber range training for government IT pros, students

This website uses cookies to enhance user experience and to analyze performance and traffic on our website. We also share information about your use of our site with our social media, advertising and analytics partners. / Do Not Sell My Personal Information

Accept Cookies