NCSC-TAD-2508-001
الرقم المرجعي: NCSC-TAD-2508-001CVSS 0
State-Sponsored Actors Target Network Infrastructure for Cyber Espionage
- نوع التهديد:
- غير متوفر
- مستوى المشاركة (TLP):
- CLEAR
- CVE:
- CVE-2024-21887, CVE-2024-3400, CVE-2023-20198, CVE-2023-20273, CVE-2018-0171
نظرة عامة
State-sponsored threat actors are compromising network infrastructure to maintain long-term access, collect sensitive information, and conduct cyber espionage.
The attackers exploit known vulnerabilities in routers, firewalls, and VPN appliances. They modify device configurations, create unauthorized accounts, and abuse trusted connections to access additional networks. Traffic mirroring, packet capture, and covert tunnels are used to collect and transfer data while avoiding detection.
التقنيات المتأثرة
- Cisco IOS/IOS XE devices
- Ivanti Connect Secure and Policy Secure
- Palo Alto Networks PAN-OS with GlobalProtect
إجراءات الحد من المخاطر والإجراءات الفورية
- 01
Prioritize patching internet-facing network devices, particularly those affected by known exploited vulnerabilities.
- 02
Review configurations for unauthorized accounts, routing changes, tunnels, traffic mirroring, and authentication settings.
- 03
Investigate unexpected virtual containers and suspicious administrative activity on network devices.
- 04
Disable unused services and unencrypted management protocols, including Telnet, FTP, and HTTP.
- 05
Replace default administrative credentials and use public-key authentication where operationally feasible.
- 06
Centralize logs and alert on unusual administrative access and configuration changes.
- 07
Investigate the full scope of suspected compromise and coordinate remediation to remove all attacker access.