Legacy IT infrastructure hosted Chinese spies inside a US engineering firm for months
Risk of shadow IT continues to rise
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
Chinese state-sponsored hackers were snooping around a US-based global engineering firm for months, trying to steal classified information, blueprints,login credentials, and other sensitive data.
An exclusive report byThe Register, discussed the news with John Dwyer, Director of Security Research at Binary Defense, a managed detection and response firm that was brought in to investigate, once the attack was discovered.
The target company was not named, but it was describes as making, “components for public and private aerospace organizations and other critical sectors, including oil and gas.” The hacking collective was also not precisely identified, although the researchers did say they believed it to be Chinese, and state-sponsored, at that.
Unmanaged IT
The group made its way into the company’s infrastructure through three unmanaged AIX servers. These IBM-made servers are running the Advanced Interactive eXecutiveoperating system, a UNIX-based OS, and apparently, still had the default login credentials. That allowed threat actors to brute-force their way in, after which they established persistence and lurked for months. The researchers believe the intrusion originally occurred in March this year.
The group’s goal was to harvest information, which could later probably be used in supply chain attacks. Since the organization makes gear for critical sectors, the risk of important hardware going bust was real.
The victim company hadendpoint detection and response(EDR) systems set up. However, these AIX servers were so old that they weren’t compatible with the EDR and as such were not monitored.The Registerdescribed them as “long- or almost-forgotten machines,” shadow IT deployments that are often not managed at all.
However, when the crooks tried to dump the memory of the LSASS process on a Windows server (a “common way to harvest credentials," the publication states), they were spotted, and blocked.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
ViaThe Register
More from TechRadar Pro
Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.
Nokia confirms data breach leaked third-party code, but its data is safe
Rising AI threats are making firms turn back to human intelligence
Black Friday is here: Sony XM5 over-ears drop to their lowest-seen price – act fast!
