CISA: Chinese state hackers are exploiting F5, Citrix, Pulse Secure, and Exchange bugs

[silversurfer]

Content source

https://www.zdnet.com/article/cisa-chinese-state-hackers-are-exploiting-f5-citrix-pulse-secure-and-exchange-bugs/

The Cybersecurity and Infrastructure Security Agency (CISA) has published a security advisory today warning of a wave of attacks carried out by hacking groups affiliated with China's Ministry of State Security (MSS).

CISA says that over the past year, Chinese hackers have scanned US government networks for the presence of popular networking devices and then used exploits for recently disclosed vulnerabilities to gain a foothold on sensitive networks.

The list of targeted devices includes F5 Big-IP load balancers, Citrix and Pulse Secure VPN appliances, and Microsoft Exchange email servers.

For each of these devices, major vulnerabilities have been publicly disclosed over the past 12 months, such as CVE-2020-5902, CVE-2019-19781, CVE-2019-11510, and CVE-2020-0688, respectively.

CISA: Chinese state hackers are exploiting F5, Citrix, Pulse Secure, and Exchange bugs

CISA says attacks have started a year ago and some have been successful.

www.zdnet.com

 

[[correlate]]

Chinese Ministry of State Security-Affiliated Cyber Threat Actor Activity | CISA

us-cert.cisa.gov

 

[Andy Ful]

In fact, both US and China have a great history of hacking/spying each other. Any country that is a serious player in world politics has to spy a lot. But, it seems that in the last century, more profits from it were on the China side, especially the profits from stolen patents and technical innovations.
Anyway, the world had stolen over the last millennium many innovations from China, too. I am drinking coffee (at this moment) from one of them.

 

[silversurfer]

Microsoft Exchange Servers Still Open to Actively Exploited Flaw

Despite Microsoft issuing patches almost eight months ago, 61 percent of Exchange servers are still vulnerable.

threatpost.com

However, new telemetry found that out of 433,464 internet-facing Exchange servers observed, at least 61 percent of Exchange 2010, 2013, 2016 and 2019 servers are still vulnerable to the flaw.
“There are two important efforts that Exchange administrators and infosec teams need to undertake: verifying deployment of the update and checking for signs of compromise,” said Tom Sellers with Rapid7 in a Tuesday analysis.