A New Chinese APT Debuts and React2Shell Attacks Spike

It's a different approach and it's backed by some data, which is a interesting idea in the security world. It's not backed by vibes or best guesses. So it's a really great conversation. We talked for over an hour. We talked about a whole bunch of things, some of the security industry history, why 0 days matter sometimes and usually not all that much. What organizations should be doing in terms of prioritizing vulnerability patching, how they make those decisions, how to justify those decisions with the board and the C-Suite and other folks that are involved. So that should be up early next week. That'll be on this feed as well as the podcast or excuse me, the YouTube channel.

So look out for that. And we also will have some of our hacker movie episodes coming soon as well. We don't, I don't want to give away exactly which ones we're doing in the next few weeks, but we have plenty of good ones coming. So keep an eye out for those. All right, on to the news. So there were a couple of stories I wanted to highlight from this week. The 1st is some research that our old friends and former colleagues at Cisco Talos released this week on a new, I guess newly disclosed Chinese APT that they identify as UAT 7290. All of these threat Intel teams have their own naming conventions, as we've talked about many times on this podcast.

And this is a group that Talos identifies as a Chinese Nexus APT group that's been active since at least 2022. Teller specifically was looking at some of their recent activity into and some interesting targeting changes that the group has made as well as some of the malware and implants that the group uses. So UAT 7290 historically has focused on attacking telecom providers mostly in South Southeast Asia, but recently I guess modified or expanded their targeting to also include some countries in southern Southeastern Europe. So it's an it's always interesting when APT teams decide to expand their victimology. A lot of times, especially for state backed actors, that is because they're getting

different tasking from their their bosses essentially, whether that happens to be the intelligence agency that they work for. Sometimes it's a military branch, whatever it happens to be, a lot of times it's because they essentially have different assignments. So UAT 7290 has a dual role in this ecosystem and it serves as both an initial access group, not an not an initial access broker. They're not selling access to victim organizations, but they're tasked with gaining initial access to target organizations.

And they also perform cyber espionage activities, which is, you know, a lot of times you see APT teams that specialize in one thing or another. There might be groups that are very good at initial access, you know, exploiting vulnerabilities, finding other ways in, you know, targeting help desks, whatever the case may be. And then there are other groups that are then tasked with taking over those those victims and gathering the the intelligence that is the main goal of these operations.

This group happens to have dual tasking and looks like so it's something to keep an eye on. And it, it, this group also shares some common TTPS with some other Chinese Nexus AP TS, including, you know, the exploitation of bugs in networking edge devices, which is not a, a unique TTP. Everybody does that because there's so many of them. And it's a great way to get into an enterprise network. They also use open source web shells for persistence.

Again, that's a common TTP. And they use compromised infrastructure as part of their operations. You see this sometimes with APT groups as well as some cybercrime groups that will look around and find already compromised boxes, routers, network edge devices that some other actor has taken the time to compromise and then use them for their own their own purposes.

It happens relatively frequently, but that's just one of the things that Talos noticed about this group. They also have some really interesting custom malware that they use. They have a few different ones that I would encourage everybody to go. And we have a story up on this on Decipher. You can also read Talos's research as well. I'll link to that in the show notes. But this group, UAT 7290, has several different pieces of malware, both Linux and Windows based malware.

So they have a dropper that's called Rush Drop. This is the Linux side of things. Another piece of malware called drive switch which is then used to execute the main implant which is called silent RAID. So silent RAID is the persistence mechanism and it has a whole bunch of, you know, the typical functionality that you would expect in in a malware implant from an APT group. So UAT 7290 looks like a relatively new player in the Chinese APT world. There's that's a crowded landscape. As everybody knows, there's an unknowable but large number of APT groups that operate from China and with Chinese, you know, authority and backing.

So this is just another one to to put on that that menu. The second big story that I wanted to mention this week is some research that our friends at Gray Noise released on targeting activity that's still going after that React to shell bug that was disclosed about a month ago. Now. You know, this is a critical RCE bug in the React server components library also affected a bunch of downstream things. And it was kind of a one of those fire drill bugs at the beginning of December when it was initially disclosed, there was a lot of exploit activity going on. Then there was public proof of concepts that came out. A lot of the early exploit activity, interesting enough was seen from red teams, which is not atypical. You see that quite often with something like this That's, that affects a large number of large

number of organizations and a whole bunch of apps. So, you know, you have red teams immediately going to see what they have in their environments, what they have in, you know, external red teams looking at their their clients environments, that sort of thing. And that can spike the exploit activity volume that you see immediately after a disclosure like this. That's what happened. But now a month later, Grainoy said that they're still seeing after a peak of about 430,000 attacks, attack sessions per day at the end of December, the volume has come down a little bit, but it's still in the 300 to 400,000 range per day, which is a huge volume for something like this. I mean, this is a, a big, you know, vulnerability that got a ton of publicity.

It got a lot of attention from threat and tell teams, you know, Sisa, all the usual suspects were urging everybody to up upgrade and patch and all that kind of stuff. But the fact that there's still that much exploit activity a month out from the initial disclosure is an interesting tidbit. And it's not just coming from, you know, obviously with that volume of of activity, it's not coming from one or two places. It's coming from all over the place. A lot of it is coming from cloud infrastructure, obviously AWS, places like that, but the attackers them, so you know, whoever the attackers are.

But behind these, it's a wide range of of people as you might expect, you know, cybercrime groups, APT groups, I'm sure there's still some red teams in there, some offensive security researchers, folks poking around to see, you know, what's still vulnerable a month after after the fact. So if you are listening to this and have not updated everything that has this react to shell vulnerable, react to shell library associated with it, you got to do that.

I mean it's it's been almost 5 weeks since the initial disclosure. Obviously it's not always easy to go and patch everything immediately, but this is one that is obviously seeing a lot of attention from a variety of attacker groups, you know, organized discipline groups as well as opportunistic attackers that are just looking for a way into any organization and then figuring it out from there. But this is obviously something you want to pay attention to, even though it's been, it's a month old, Please, you know, go and patch it if you, if you haven't already.

Gray Noise said that they've seen a total of more than 8.1 million attack sessions in a month. It's quite a large number. You can go and look at their data. They have a good public data set that they've shared and it shows you some of the ASNS that are involved. So if you want to have a good look at where the attack activity is coming from and what kind of apps are being targeted, that's the place to go and look. So those are the two things I wanted to really highlight for this week. As I said at the beginning, keep an eye out for my podcast with Jeremiah Grossman and Robert Hansen that'll be coming early to mid next week.

That'll be both on this feed as well as the YouTube channel. It'll be on the Decipher dot SC site as well, obviously. And also keep an eye out for the hacker movie podcasts that are coming. If folks have suggestions or movies that they really want to see, see us do on the podcast, please let us know. We have a pretty long list of ones that we're going to get to in the in the coming weeks and months. Some of which are, you know, traditional hacker movies that you might expect.

Others are not quite, as you know, obvious choices. But we're, we have a very loose definition of what a hacker movie is. So if you want to throw a few at us, please do. Again, my e-mail address Dennis at decipher dot SC and I'd be happy to hear any of those suggestions. So thanks everybody for listening and have a great week.