Chinese Government Appears to Have Stolen Data From Nearly Every North American in Yearslong Cyberattack: Report
https://breaking-news.ca/chinese-government-appears-to-have-stolen-data-from-nearly-every-north-american-in-yearslong-cyberattack-report/
Chinese cyber group Salt Typhoon may have stolen data on nearly every American. The cyberespionage campaign was global, affecting over 80 countries. Stolen data could let Chinese intelligence track targets via telecom networks—politicians, spies, activists.
Countering Chinese State-Sponsored Actors
Compromise of Networks Worldwide to Feed Global
Espionage System
Executive summary
People’s Republic of China (PRC) state-sponsored cyber threat actors are targeting networks globally, including, but not limited to, telecommunications, government, transportation, lodging, and military infrastructure networks. While these actors focus on large backbone routers of major telecommunications providers, as well as provider edge
(PE) and customer edge (CE) routers, they also leverage compromised devices and trusted connections to pivot into other networks. These actors often modify routers to maintain persistent, long-term access to networks.
This activity partially overlaps with cyber threat actor reporting by the cybersecurity industry—commonly referred to as Salt Typhoon, OPERATOR PANDA, RedMike, UNC5807, and GhostEmperor, among others. The authoring agencies are not adopting a particular commercial naming convention and hereafter refer to those responsible for the cyber threat activity more generically as “Advanced Persistent Threat (APT) actors” throughout this advisory. This cluster of cyber threat activity has been observed in the United States, Australia, Canada, New Zealand, the United Kingdom, and other areas globally.
This Cybersecurity Advisory (CSA) includes observations from various government and industry investigations where the APT actors targeted internal enterprise environments, as well as systems and networks that deliver services directly to customers. This CSA details the tactics, techniques, and procedures (TTPs) leveraged by these APT actors to facilitate detection and threat hunting, and provides mitigation guidance to reduce the risk from these APT actors and their TTPs.
This CSA is being released by the following authoring and co-sealing agencies: Continue…