U.S. and international agencies warn of China-based cyber group APT40 threat; APT40 targets public infrastructure, exploits software vulnerabilities like Log4J, and seeks user credentials

A joint advisory issued the week of July 8 by the Cybersecurity and Infrastructure Security Agency, National Security Agency, FBI and several international agencies warns of the threat of a state-sponsored cyber group in China. The Advanced Persistent Threat (APT) 40, also known as Kryptonite Panda, GINGHAM TYPHOON, Leviathan and Bronze Mohawk, has previously targeted organizations in the United States and other countries. APT40 is exploiting newly public vulnerabilities in widely used software such as Microsoft Exchanges, Log4J and Atlassian Confluence. The group appears to prefer exploiting public-facing infrastructure using techniques such as phishing campaigns and places a high priority on obtaining user credentials to enable a range of activities. 
  
"According to the authoring agencies, APT40 is operating on behalf of China’s Ministry of State Security," said John Riggi, AHA national advisor of cybersecurity and risk. "The report notes that this hacking group had previously been involved in the theft of medical research related to infectious diseases. This useful technical bulletin describes in detail how this group appears to prefer exploiting vulnerable, public-facing infrastructure over techniques that require user interaction, such as phishing campaigns, and places a high priority on obtaining valid credentials to enable a range of follow-on activities to enable penetration of high value networks and theft of sensitive data. Based upon this report, it is assessed that APT40 may pose a particular risk to health care organizations that have significant unpatched internet facing vulnerabilities and are engaged in sensitive medical research and innovation. Organizations fitting this risk profile should implement the report’s recommended mitigations."   
 
For more information on this or other cyber and risk issues, contact Riggi at jriggi@aha.org. For the latest cyber and risk resources and threat intelligence, visit aha.org/cybersecurity.