Chinese state-sponsored hackers were snooping around a US-based global engineering firm for months, trying to steal classified information, blueprints, login credentials, and other sensitive data.
An exclusive report by The Register, discussed the news with John Dwyer, Director of Security Research at Binary Defense, a managed detection and response firm that was brought in to investigate, once the attack was discovered.
The target company was not named, but it was describes as making, “components for public and private aerospace organizations and other critical sectors, including oil and gas.” The hacking collective was also not precisely identified, although the researchers did say they believed it to be Chinese, and state-sponsored, at that.
Unmanaged IT
The group made its way into the company’s infrastructure through three unmanaged AIX servers. These IBM-made servers are running the Advanced Interactive eXecutive operating system, a UNIX-based OS, and apparently, still had the default login credentials. That allowed threat actors to brute-force their way in, after which they established persistence and lurked for months. The researchers believe the intrusion originally occurred in March this year.
The group’s goal was to harvest information, which could later probably be used in supply chain attacks. Since the organization makes gear for critical sectors, the risk of important hardware going bust was real.
The victim company had endpoint detection and response (EDR) systems set up. However, these AIX servers were so old that they weren’t compatible with the EDR and as such were not monitored. The Register described them as “long- or almost-forgotten machines,” shadow IT deployments that are often not managed at all.
However, when the crooks tried to dump the memory of the LSASS process on a Windows server (a “common way to harvest credentials,” the publication states), they were spotted, and blocked.
Via The Register