BackdoorDiplomacy Attacks Diplomats in The Middle East & Africa

A threat group known as BackdoorDiplomacy is targeting telecommunication industries and Ministries of Foreign Affairs in Africa and the Middle East by exploiting vulnerable internet-facing web servers. The group exploits CVE-2020-5902 in F5 and vulnerabilities in Microsoft Exchange server to deploy the China Chopper web shell and a custom backdoor called Turian. The attackers also use open-source tools to steal information from removable devices, take screenshots, and delete, write or move files.