Alert (AA20-352A)

Advanced Persistent Threat Compromise of Government Agencies, Critical Infrastructure, and Private Sector Organizations

Summary

This Alert uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) version 8 framework. See the ATT&CK for Enterprise version 8 for all referenced threat actor tactics and techniques.

The Cybersecurity and Infrastructure Security Agency (CISA) is aware of compromises of U.S. government agencies, critical infrastructure entities, and private sector organizations by an advanced persistent threat (APT) actor beginning in at least March 2020. This APT actor has demonstrated patience, operational security, and complex tradecraft in these intrusions. CISA expects that removing this threat actor from compromised environments will be highly complex and challenging for organizations.

One of the initial access vectors for this activity is a supply chain compromise of the following SolarWinds Orion products (see Appendix A).

Orion Platform 2019.4 HF5, version 2019.4.5200.9083

Orion Platform 2020.2 RC1, version 2020.2.100.12219

Orion Platform 2020.2 RC2, version 2020.2.5200.12394

Orion Platform 2020.2, 2020.2 HF1, version 2020.2.5300.12432

Note: CISA has evidence of additional initial access vectors, other than the SolarWinds Orion platform; however, these are still being investigated. CISA will update this Alert as new information becomes available.

On December 13, 2020, CISA released Emergency Directive 21-01: Mitigate SolarWinds Orion Code Compromise, ordering federal civilian executive branch departments and agencies to disconnect affected devices. Note: this Activity Alert does not supersede the requirements of Emergency Directive 21-01 (ED-21-01) and does not represent formal guidance to federal agencies under ED 21-01.

CISA has determined that this threat poses a grave risk to the Federal Government and state, local, tribal, and territorial governments as well as critical infrastructure entities and other private sector organizations. CISA advises stakeholders to read this Alert and review the enclosed indicators (see Appendix B).

Key Takeaways

This is a patient, well-resourced, and focused adversary that has sustained long duration activity on victim networks.

The SolarWinds Orion supply chain compromise is not the only initial infection vector this APT actor leveraged.

Not all organizations that have the backdoor delivered through SolarWinds Orion have been targeted by the adversary with follow-on actions.

Organizations with suspected compromises need to be highly conscious of operational security, including when engaging in incident response activities and planning and implementing remediation plans.

Click here for a PDF version of this report.

https://us-cert.cisa.gov/sites/default/files/publications/AA20-352A-APT_Compromise_of_Government_Agencies%2C_Critical%20Infrastructure%2C_and_Private_Sector_Organizations.pdf

https://us-cert.cisa.gov/ncas/alerts/aa20-352a

CNN and the New York Times Support Chinese Communist-Funded ‘Marxist Journalism’ School

Tsinghua University’s journalism school, which vows to produce journalists adherent to the Chinese Communist Party’s standards of “Marxist journalism,” enjoys support from a host of American corporates and establishment media outlets such as Bloomberg, CNN, the New York Times, and Facebook.

CORPORATE COLLABORATORS.

Financial supporters of the Global Business Journalism School, which aims to “apply Marxist theory” to journalism, include Bank of America, Bloomberg, consulting giant Deloitte, and the John S. and James L. Knight Foundation.

The university claims the following Western news entities provide “talent, equipment, and internships” as part of a “long history of cooperation” with Chinese Communist Party (CCP)-controlled Tsinghua:

The New York Times;

CNN;

Financial Times;

Reuters;

Bloomberg.

Also listed as collaborating on the explicitly Marxist venture are individuals such as CNN host Fareed Zakaria and Facebook Vice President Lori Goler, who both served as guest lecturers in 2017.

Bloomberg’s Editor-at-Large and columnist Lee Miller is listed as a professor, while Leslie Wayne, a contributor and former business reporter at the New York Times, is a Visiting Fellow. Also included in the ranks of professors and fellows are a host of CCP apparatchiks.

These companies, in collaborating with the CCP, are actively aiding and abetting President Xi Jinping and his 2016 diktat that “wherever the readers are, wherever the viewers are, that is where propaganda reports must extend their tentacles.”

Given Tsinghua is wholly funded by the Chinese government, such ties appear to present a conflict of interest in the aforementioned outlets’ coverage of China.

https://thenationalpulse.com/politics/establishment-media-collaborators/

BEIJING BENSON: State Sec Demanding Data Deletion Taught U.S. Election Details to CCP Students at Xi Jinping’s Alma Mater

Michigan Secretary of State Jocelyn Benson – currently obstructing efforts to investigate Michigan’s election results – developed ties with Chinese state-run universities and trained lawyers for the Chinese Communist Party – even delivering a lecture at Chinese Premier Xi Jinping’s alma mater – The National Pulse can reveal.

Benson undertook the work aiding the Chinese Communist Party while serving as the Dean of Wayne Law School in Detroit, Michigan.

Benson – who oversaw a state allegedly riddled with election fraud and told county clerks to “destroy certain election data and software” – visited China in June 2013 in an attempt to court students from Chinese Communist Party-run universities into studying at Wayne State University’s Law School.

‘Vigorous Outreach.’

Wayne State’s own website maintains the press release from 2013 which describes Benson’s efforts to link up with the Chinese Communist Party as “vigorous”:

“A growing number of students from China are expected to study at Wayne State University Law School in 2014 — a result of the school’s decision to offer a master’s degree in U.S. law and its vigorous outreach efforts to promote it.”

Benson wanted to provide individuals who could work in Chinese “government ministries involved in negotiations with the U.S.” with legal training from her Detroit-based institution:

“Wayne’s new master’s degree program in U.S. law is designed for outstanding law students from other countries. This will be an attractive program for students who seek to practice law in the United States, transnational law in their home countries, who may work in government ministries involved in negotiations with the United States, or who intend to work on advanced degrees and careers as scholars.”

Benson described the nearly week-long trip as “very productive,” and visited several Chinese law schools, one of which – China University of Political Science and Law – forged a partnership with Wayne Law that would “include an exchange of professors as well as new law students coming to Detroit to study American law.”

https://thenationalpulse.com/exclusive/benson-michigan-taught-election-law-to-ccp-xi-students/

Australian Authorities Find Junket Tour Industry a Haven for Organized Crime

Australian government agency that tracks criminal abuse of the financial system has found the country’s package tour industry a high risk sector for money laundering, financing of terorrism and organized crime, the agency’s latest report revealed.

Transaction Reports and Analysis Centre (AUSTRAC) stressed that “some junkets have been infiltrated by criminals including Asian crime group members and transnational money laundering operations.” The infiltration is something AUSTRAC thinks is encouraged by the inherent vulnerability of the Junket business model.

A junket tour is a kind of package trip where guests are taken by the tour operators to a variety of curated entertainment houses, which almost always include casinos.

In return for bringing clients to the casinos, the junket tour operators (JTOs) receive commission based on the guests’ gambling activities, read the report.

“At a sector level, the junket model has a number of money laundering vulnerabilities,” AUSTRAC explained. For one, the funds tour guests use at casinos are often held and managed by the JTO, so that guests may focus on their gambling.

The agency added that a key vulnerability is the “lack of transparency and level of anonymity created by the pooling of all players’ funds and transactions under the name of the JTO, and that the financial arrangements between the JTO and junket players are not disclosed to the casino.”

The report said that more than 1,000 junket programs exist in Australia and 61 percent of Australian casinos work with JTOs to bring in guests, while suspicious matter reports submitted to AUSTRAC, catalogued questionable transactions by junket tour operators valued at more than US$274 million.

Nearly half of those reports were suspected cases of money laundering, according to AUSTRAC.

To combat the trend, the agency suggested the implementation of several measures to increase transparency of JTOs.

AUSTRAC stressed that casinos need to conduct greater due diligence on JTOs that they engage with, including an application process and identity verification procedures.

https://www.occrp.org/en/daily/13545-australian-authorities-find-junket-tour-industry-a-haven-for-organized-crime

What Are Governors Doing To Counter Communist China? The Answer Is Disturbing

Communist China’s nefarious activities directly intersect with a number of areas over which governors can effect change, so what are our leaders doing?

In recent days, Americans have seen clearly the staggering extent of the Chinese Communist Party’s influence efforts. Americans now know that Chinese agents cultivated relationships with not just former Senate Intelligence Committee Chair Dianne Feinstein, D-Calif., but current House Intelligence Committee member Eric Swalwell, D-Calif., whom the CCP strategically approached from the start of his political ascent as a city councilmember.

Americans also now know that the story the corporate and social media did everything possible to kill in the run-up to the 2020 presidential election was no Russian information operation: Hunter Biden is under federal criminal investigation. Part of that investigation reportedly concerns his allegedly illicit business dealings with CCP-linked people and entities. Said dealings might well implicate the “big guy,” his father, Joe Biden.

These stories made the explosive yet plausible remarks of Renmin University School of International Studies Associate Dean Professor Di Dongsheng, recently sent viral by Tucker Carlson, ring all the more true. According to a translation, during a November 2020 panel Di claimed China’s “friends” on Wall Street had influenced American policy since the 1970s through opening American banking to China.

He also said Wall Street’s influence — and by extension, China’s — had waned greatly during the Trump presidency, and that the prospects of China influencing U.S. policy would again likely wax under a Biden presidency, thanks to the Wall Street-tied establishment’s likely resurgence and Hunter’s “business” activities.

Given the alarm bells these stories raise, punctuating China’s history of domestic oppression and international aggression, one would think our elected officials would be doing everything they can to defend the homeland against the interference of rich, strong, and powerful China. These troubling realities should stir the American public to demand action and leadership from their governors.

Are they taking up the charge? Judging by the author’s survey of all 50 governor’s offices across the country, the answer is at best inconclusive and thus highly troubling.

What Are Governors Doing — or Not Doing?

Why should we care what governors are doing to counter the CCP’s malign efforts? National security matters generally fall to the federal government. As the CCP utilizes the likes of Swalwell, Hunter Biden, and Wall Street financiers, however, it becomes clear that the regime’s malevolent efforts persist far outside the corridors of Washington, D.C.

https://thefederalist.com/2020/12/17/what-are-governors-doing-to-counter-communist-china-the-answer-is-disturbing/

Here’s what is changing after the FinCEN Files shook the world of banking

After ICIJ and BuzzFeed News published a joint investigation, officials across the globe began to take action to thwart criminals and illicit financial activity.

Exposing a torrent of dirty money that the world’s most powerful banks transact in plain view of government regulators, the FinCEN Files investigation has roiled the financial industry like few stories since the Great Recession — and catalyzed forceful action in the US and beyond.

In the weeks after BuzzFeed News, the International Consortium of Investigative Journalists, and 108 newsrooms around the world began publishing stories based on a cache of secret records, U.K. lawmakers launched a formal inquiry into Britain’s oversight of banks, members of the European Parliament advocated for a stronger response across the continent, and investigations were opened in countries ranging from Turkey to Thailand to Liberia.

Significantly, the FinCEN Files provided a final push in Washington, D.C., for passage of a momentous new law taking aim at one of the most effective money laundering tools cited in the stories: anonymous shell companies. The legislation, passed last week with overwhelming bipartisan support, requires many of these secretive American companies to disclose who owns them and who profits from them.

The Corporate Transparency Act marks the most substantial revision to anti–money laundering laws since the Patriot Act in 2001.

Provisions in the legislative package, tucked into the annual defense spending bill, also address many of the other systemic problems identified in the FinCEN Files, which exposed the ineffectiveness of government oversight and the myriad ways that banks fail to stanch the flow of dirty money.

Among those reforms: The Justice Department would have to file yearly reports justifying its use of deferred prosecution agreements — sweetheart deals allowing banks that have run afoul of anti–money laundering laws to avoid trial and criminal convictions. The U.S. Treasury Department would also seek new technologies to better identify criminal money flows and to increase communication between the private sector and federal agencies. And those who blow the whistle on misconduct would get new protections.

Although President Donald Trump has vowed to veto the overarching bill — because it does not revoke an unrelated set of protections for social media companies — lawmakers could override the veto.

Public officials have cited the BuzzFeed News–ICIJ investigation as a reason the reforms gained support after years of inaction. “The BuzzFeed story makes clear we need to strengthen, reform, and update our nation’s anti–money laundering laws,” said Sen. Sherrod Brown, the top Democrat on the Senate Banking Committee. “This action is long overdue.”

https://www.icij.org/investigations/fincen-files/heres-what-is-changing-after-the-fincen-files-shook-the-world-of-banking/

Biogen Agrees To Pay $22 Million To Resolve Alleged False Claims Act Liability For Paying Kickbacks

https://www.justice.gov/opa/pr/biogen-agrees-pay-22-million-resolve-alleged-false-claims-act-liability-paying-kickbacks

Report: Over 100K Georgians who didn’t vote on Election Day have requested ballots for Senate runoffs — and they skew Democratic

Things are heating up in Georgia

More than 100,000 voters who did not vote in Georgia on Election Day have requested mail-in ballots for the state's upcoming Senate runoffs, and the sampling of demographics show they probably lean Democratic, a new report from the Peach State revealed.

As of Thursday afternoon, 108,625 Georgians who did not vote in the November election have applied for ballots to vote in the Jan. 5 runoffs, according to data from georgiavotes.com. The tracking site uses publicly available information from the Georgia secretary of state's website.

The figure, which amounts to 6.3% of all mail-in ballot requests, could be enough to sway results in an election that is expected to be close. Democratic challenger Joe Biden defeated President Trump in the state by a narrow margin of just under 12,000 votes. Both Republican Sens. David Perdue and Kelly Loeffler failed to win a 50% majority of the vote, which sent each race to a runoff.

The demographic breakdown of the new runoff applicants skew toward traditionally Democratic voting groups, with non-white voters making up the majority of the sampling. More than 42,000 are white voters while nearly 38,000 are black voters, and the remaining 28,000 classified themselves as Hispanic, Asian, and other.

The demographic breakdown, though perhaps concerning, is certainly not an assurance that Democrats will take the seats due to the fact that Republicans made historic inroads with minority groups during the 2020 election.

What else?

The highly anticipated runoff elections are also reportedly drawing completely new Georgia voters into the state's voter pool. According to the Atlanta Journal-Constitution, nearly 75,000 new voters have registered in the state since the presidential election in November. The news outlet pulled the data from an updated voter registration list purchased from the secretary of state's office.

The Journal-Constitution noted that the new voters are "overwhelmingly young, with 57% of them under 35 years old. Some are new Georgia residents; others just turned 18."

It's worth noting that Georgia Republican Secretary of State Brad Raffensperger has warned against out-of-state voters temporarily relocating to Georgia to vote in the runoffs. To do so is a felony.

https://www.theblaze.com/news/100k-georgians-election-day-ballots-senate-runoffs

Fauci Wants Christmas Canceled: "Just One Of The Things You're Going To Have To Accept"

Dr. Anthony Fauci declared this week that he believes Christmas celebrations between family members should be canceled, warning that it’s “just one of the things you’re going to have to accept as we go through this unprecedented challenging time.”

Fauci made the comments in an interview with the Washington Post, noting that over the holidays “I’m going to be with my wife — period.”

“The Christmas holiday is a special holiday for us because Christmas Eve is my birthday. And Christmas Day is Christmas Day.” Fauci said, adding “And [my daughters] are not going to come home … That’s painful.”

Fauci urged that Christmas get togethers must be curbed because “We have a big problem. Look at the numbers — the numbers are really quite dramatic.”

“Stay at home as much as you can, keep your interactions to the extent possible to members of the same household,” he added.

“This cannot be business as usual this Christmas because we’re already in a very difficult situation, and we’re going to make it worse, if we don’t do something about it,” Fauci further declared.

Fauci also complained that the “independent spirit in the United States of people not wanting to comply with public health measures has certainly hurt us a bit.”

“There are people in various parts of the country who still believe that [COVID-19] is a hoax, that it’s fake - even when in their own state the hospitals have been overrun with patients in the hospital beds and in the intensive care unit,” Fauci said, adding “That’s very unusual to see a situation like that, but that is what is going on in this country.”

Last week, Fauci declared that face masks and distancing restrictions are here to stay unless enough Americans get the coronavirus vaccination, and even then it will take at least six months before the masks can be left behind.

https://www.zerohedge.com/covid-19/fauci-wants-christmas-canceled-just-one-things-youre-going-have-accept

Vaccines: Did Big Pharma Purchase California’s Legislative Machinery?

California has some of the most stringent vaccine mandate laws in the United States. Why is that? At first, it seemed that draconian vaccination laws were introduced in response to a measles outbreak that began in Disneyland in 2014. But then later, long after the measles threat had evaporated, California’s vaccine mandate was made even stricter. It came as a shock. California’s mandate-imposing Senator Pan, himself a pediatrician, had promised this would never occur.

While everyone is familiar with Big Pharma’s lobby and campaign contributions to politicians in Washington, few understood that Pharma gave more than twice as much money to politicians and party committees at the state level as they gave at the federal level. Perhaps it should have come as no surprise; after all, the practice of medicine is regulated at the state level. For example, fraud committed by Big Pharma opioid companies is being litigated at the state level. Vaccine mandates are voted in or out at the state level. Some healthcare price controls are too.

How much money are we talking about? During the twenty years from January 1, 1999 through December 31, 2018, the pharmaceutical and health products industry spent $877 million dollars on contributions to state candidates and party committees.

Of this amount, $399 Million, or 45.5% went to candidates and committees in California. The other 54.5% went to the other 49 states and the District of Columbia.

Candidates for state office face legal limits on what they can accept from each donor. But in many states, California and Ohio included, ballot measure committees are not subject to contribution limits. A whopping 75.4% of the money Pharma spent on state candidates and committees nationwide went to ballot measure committees.

Only two states received contributions of over $50 million dollars in total during the entire twenty-year period: California and Ohio. Ohio received $74 million total, and California $399 million.

Now I am rethinking the California legislature’s votes to impose extremely strict vaccine mandates on its citizens. Had Big Pharma already purchased California’s government machinery? Was the industry just wringing more profit from its investment in the Golden State?

This data in this article come from “Lobbying Expenditures and Campaign Contributions by the Pharmaceutical and Health Product Industry in the United States, 1999-2018” published in JAMA Internal Medicine on March 3, 2020. It was written by researcher Olivier J Wouters of the London School of Economics. The facts cited here were derived by him from data obtained by the National Institute on Money in Politics.

https://www.globalresearch.ca/did-big-pharma-purchase-california-legislative-machinery/5732482

US Joint Chiefs chairman meets with Taliban on peace talks

KABUL, Afghanistan (AP) — The top U.S. general held unannounced talks with Taliban peace negotiators in the Persian Gulf to urge a reduction in violence across Afghanistan, even as senior American officials in Kabul warned that stepped-up Taliban attacks endanger the militant group’s nascent peace negotiations with the Afghan government.

Army Gen. Mark A. Milley, chairman of the Joint Chiefs of Staff, met for about two hours with Taliban negotiators in Doha, Qatar, on Tuesday and flew Wednesday to Kabul to discuss the peace process with Afghan President Ashraf Ghani.

Milley’s meetings came amid a new drawdown of U.S. troops, although under current U.S. policy a complete pullout hinges on the Taliban reducing attacks nationwide.

“The most important part of the discussions that I had with both the Taliban and the government of Afghanistan was the need for an immediate reduction in violence,” Milley told three reporters, including one from The Associated Press, who accompanied him to Qatar and Afghanistan. “Everything else hinges on that.”

Under ground rules set by Milley for security reasons, the journalists traveling with him agreed not to report on either set of talks until he had departed the region. It was Milley’s second unannounced meeting with the Taliban’s negotiating team; the first, in June, also in Doha, had not been reported until now.

Although Milley reported no breakthrough, his Taliban meetings represent a remarkable milestone — America’s top general coming face-to-face with representatives of the group that ruled Afghanistan until it was ousted 19 years ago this month in the early stages of what became America’s longest war. Milley served three tours of duty in Afghanistan, the first in 2003 and the last in 2013-14.

Army Gen. Scott Miller, the top commander of U.S. and coalition forces in Afghanistan, said in an interview at his military headquarters in Kabul on Wednesday that the Taliban have stepped up attacks on Afghan forces, particularly in the southern provinces of Helmand and Kandahar, and against roadways and other infrastructure.

“My assessment is, it puts the peace process at risk — the higher the violence, the higher the risk,” Miller said. Miller meets at least once a month with Taliban negotiators as part of Washington’s effort to advance a peace process.

https://www.militarytimes.com/news/your-military/2020/12/17/us-joint-chiefs-chairman-meets-with-taliban-on-peace-talks/

What the American Aristocracy Has Wrought

Over the centuries, the world has always been governed by self-serving aristocracies — rich, privileged rulers whose edicts wear down their populaces. Truly democratic elections are not common, because that would impede the aristocracy's ability to rule as they please.

What used to be special about America is that it was set up to be governed by a citizen leadership — a government "of the people, by the people and for the people," as Lincoln summarized it in his Gettysburg Address. For over 200 years, our nation has mostly succeeded in maintaining fair elections and holding back one-party rule. But in recent times, a veil has been lifted to show us the reality of our subjugation.

President Donald Trump has been the rare epitome of a president "of the people, by the people and for the people," but the four years of his presidency have uncovered an unpleasant reality: there is a gigantic thumb on the scale in federal politics, courtesy of a group who could ill afford the success of a citizen president.

For his entire term, every absurd charge against President Trump was investigated, with daily leaks and blockbuster stories that amplified outright falsehoods. His surrogates, supporters, and family have been relentlessly (and frivolously) persecuted. Meanwhile, not a single legally compelling case against the Bidens, the Clintons, or the Obama administration has resulted in mainstream media attention, let alone prosecution. Investigations have all been half-hearted and perfunctory. The DOJ always declines to prosecute, regardless the obvious merits.

The mainstream media have been in lockstep with the #Resistance, liberal court orders, and the critically stupid — Schumer, Schiff, Pelosi, Ocasio-Cortez, Swalwell, Waters, Nadler, et al. Journalists never stop to investigate the veracity of their statements, despite their poor record of telling the truth, even as they maliciously "fact-check" Trump administration officials.

The courage of President Trump to stand up under relentless persecution is the story of the century. But very few politicians have stood with him. How telling is that? Trump has been remaking a party in desperate need of a renaissance. But the GOP, which appeared to vacillate for a while between the old order and the Trump movement, appears to have formally divorced the man who did more for it and for the country than any president in modern history, now that his back is against the wall. Does every GOP officeholder lack integrity and courage? There is the occasional Matt Gaetz or Josh Hawley, but most of them look entrenched against the will of the people who elected them.

https://www.americanthinker.com/articles/2020/12/what_the_american_aristocracy_has_wrought.html

>>12068178

That's bullshit when the real Taliban had the country they eliminated the heroin trade. Then as the cabal does they infiltrated it and turned it to their means. These negotiations are being done with the original Taliban. This is why they have had so many terror attacks in recent weeks to try and stop these peace deals moving forward and stopping the US troop withdrawal