Microsoft says Chinese state-sponsored hackers compromised “critical infrastructure organizations” across US industries, with a focus on gathering intelligence
aimed @ stopping relief of Taiwan in case of blockade or kinetic conflict...Biden Regime aware of this since February—same time as the airship incursion..... https://www.cnbc.com/... @nsacyber : Don't let a malicious actor take advantage of you. Learn how to hunt and mitigate a PRCstate-sponsored cyber actor who may be using your systems' resources to hide their activities. https://www.nsa.gov/... [image] Martial Gervaise / @argevise : The National Security Agency NSA has released a Cybersecurity Advisory with additional information and hunting guide for Volt Typhoon TTPs: https://www.nsa.gov/... https://twitter.com/... Microsoft customers can get ongoing analysis and access additional threat actor details. [image] Florian Roth / @cyb3rops : This TA is noisy AF .. if your EDR didn't detect and report this with level “high” or “critical” it's bloody useless https://twitter.com/... [image] Jake Williams / @malwarejake : Fantastic release from @CISACyber, @NSAGov, and many others highlighting use of living off the land techniques employed by Chinese threat actors. Your EDRs won't save you from LOLBin use, you'll usually need to write custom rules to get that coverage. https://media.defense.gov/... Rob Joyce / @nsa_csdirector : PRC cyber threats to critical infrastructure are real and use sophisticated tradecraft that doesn't always rely on malware. This advisory describes tradecraft for hunting their intrusions and detecting this activity. We want to hear about discoveries. https://media.defense.gov/... [image] Julian Ku / @julianku : “American intelligence agencies and Microsoft detected what they feared was a more worrisome intruder: mysterious computer code appearing in telecommunications systems in Guam and elsewhere in the United States."" https://www.nytimes.com/... Mark MacKinnon / @markmackinnon : “It was the focus on Guam that particularly seized the attention of officials who are assessing China's capabilities — and its willingness — to attack or choke off Taiwan.” https://www.nytimes.com/... Kim Zetter / @kimzetter : “NSA's report is part of a relatively new US...move to publish such data quickly in hopes of burning the Chinese operations. In years past, the US usually withheld such info...that almost always assured that the hackers could stay well ahead of the gov” https://www.nytimes.com/... @msftsecintel : Volt Typhoon, a Chinese state-sponsored actor, uses living-off-the-land (LotL) and hands-on-keyboard TTPs to evade detection and persist in an espionage campaign targeting critical infrastructure organizations in Guam and the rest of the United States. https://aka.ms/... @424f424f : ZOMG, look at all these open source tools this State-sponsored threat actor is using. Oh wait, they can operate without them? Who knew.. https://www.cisa.gov/... @arekfurt : It's important to really understand the implications of the fact that threat actors of many types are now regularly using legitimate remote access capabilities—both those built-in to OSes and from third party apps—to maintain persistent remote access into targets. Eric Geller / @ericgeller : Microsoft has spotted Chinese government hackers breaching “critical infrastructure organizations in Guam and elsewhere in the United States.” The hackers “live off the land” once they're inside, “rarely” using malware to achieve their goals. https://www.microsoft.com/... [image] Eric Geller / @ericgeller : CISA, NSA, FBI, and their Five Eyes partners have released an advisory about this activity, which they say could be occurring outside the U.S. as well. https://www.cisa.gov/... [image] @cisacyber : 🚨@CISAgov, @FBI, @NSACyber & international partners published a joint #cybersecurity advisory highlighting a PRC cyber actor living off the land using built-in network admin tools to evade detection & conduct malicious activity.
CCP hackers attack critical communications infrastructure in Guam—aimed @ stopping relief of Taiwan in case of blockade or kinetic conflict...Biden Regime aware of this since February—same time as the airship incursion..... https://www.cnbc.com/...
Don't let a malicious actor take advantage of you. Learn how to hunt and mitigate a PRC state-sponsored cyber actor who may be using your systems' resources to hide their activities. https://www.nsa.gov/... [image]
The National Security Agency NSA has released a Cybersecurity Advisory with additional information and hunting guide for Volt Typhoon TTPs: https://www.nsa.gov/... https://twitter.com/... Microsoft customers can get ongoing analysis and access additional threat actor details. [i…
Fantastic release from @CISACyber, @NSAGov, and many others highlighting use of living off the land techniques employed by Chinese threat actors. Your EDRs won't save you from LOLBin use, you'll usually need to write custom rules to get that coverage. https://media.defense.gov/..…
PRC cyber threats to critical infrastructure are real and use sophisticated tradecraft that doesn't always rely on malware. This advisory describes tradecraft for hunting their intrusions and detecting this activity. We want to hear about discoveries. https://media.defense.gov/..…
“American intelligence agencies and Microsoft detected what they feared was a more worrisome intruder: mysterious computer code appearing in telecommunications systems in Guam and elsewhere in the United States."" https://www.nytimes.com/...
“It was the focus on Guam that particularly seized the attention of officials who are assessing China's capabilities — and its willingness — to attack or choke off Taiwan.” https://www.nytimes.com/...
“NSA's report is part of a relatively new US...move to publish such data quickly in hopes of burning the Chinese operations. In years past, the US usually withheld such info...that almost always assured that the hackers could stay well ahead of the gov” https://www.nytimes.com/..…
Volt Typhoon, a Chinese state-sponsored actor, uses living-off-the-land (LotL) and hands-on-keyboard TTPs to evade detection and persist in an espionage campaign targeting critical infrastructure organizations in Guam and the rest of the United States. https://aka.ms/...
ZOMG, look at all these open source tools this State-sponsored threat actor is using. Oh wait, they can operate without them? Who knew.. https://www.cisa.gov/...
It's important to really understand the implications of the fact that threat actors of many types are now regularly using legitimate remote access capabilities—both those built-in to OSes and from third party apps—to maintain persistent remote access into targets.
Microsoft has spotted Chinese government hackers breaching “critical infrastructure organizations in Guam and elsewhere in the United States.” The hackers “live off the land” once they're inside, “rarely” using malware to achieve their goals. https://www.microsoft.com/... [image]
CISA, NSA, FBI, and their Five Eyes partners have released an advisory about this activity, which they say could be occurring outside the U.S. as well. https://www.cisa.gov/... [image]
🚨@CISAgov, @FBI, @NSACyber & international partners published a joint #cybersecurity advisory highlighting a PRC cyber actor living off the land using built-in network admin tools to evade detection & conduct malicious activity. More: https://cisa.gov/... [image]