Vulnerabilities Used by Chinese Threat Actors – Advisory Report

A new joint advisory from US CISA, FBI, and NSA states Chinese state–sponsored threat actors continue to exploit known vulnerabilities to target US and allied networks and companies,

They use an increasing array of new and adaptive techniques some of which pose a significant risk to Information Technology Sector organizations, Defense Industrial Base (DIB) Sector organizations, and other critical infrastructure organizations.

The  primary goals of the threat actors are to steal intellectual property and to develop access into sensitive networks, the three agencies found that they continue to use virtual private networks (VPNs) to obfuscate their activities and target web–facing applications to establish initial access.

They then use the vulnerabilities above to surreptitiously gain unauthorized access into sensitive networks, after which they seek to establish persistence and move laterally to other internally connected networks.

Recommendations for mitigating the risks:

• Update and patch systems as soon as possible. Prioritize patching vulnerabilities identified in this Cybersecurity Advisory (CSA) and other known exploited vulnerabilities
• Utilize phishing–resistant multi–factor authentication whenever possible. Require all accounts with password logins to have strong, unique passwords, and change passwords immediately if there are indications that a password may have been compromised
• Block obsolete or unused protocols at the network edge
• Upgrade or replace end–of–life devices
• Move toward the Zero Trust security model
• Enable robust logging of internet–facing systems and monitor the logs for anomalous activity