NCSC-TAD-2106-004
Reference No.: NCSC-TAD-2106-004CVSS 0
BackdoorDiplomacy Attacks Diplomats in The Middle East & Africa
- Threat Type:
- N/A
- TLP:
- CLEAR
- CVE:
- CVE-2020-5902
Overview
A threat group known as BackdoorDiplomacy is targeting telecommunication industries and Ministries of Foreign Affairs in Africa and the Middle East by exploiting vulnerable internet-facing web servers. The group exploits CVE-2020-5902 in F5 and vulnerabilities in Microsoft Exchange server to deploy the China Chopper web shell and a custom backdoor called Turian. The attackers also use open-source tools to steal information from removable devices, take screenshots, and delete, write or move files.
Affected Technologies
- Windows and Linux operating systems
- F5 products
- Microsoft Exchange server
- Internet-facing web servers
Mitigation and Immediate Actions
- 01
Immediately patch the vulnerabilities (CVE-2020-5902) by upgrading F5 products which are BIG-IP, BIG-IQ and Traffix SDC to the latest versions.
- 02
Make sure that the Microsoft Exchange server is up to date.
References
- BackdoorDiplomacy: Upgrading from Quarian to Turian. (n.d.). Retrieved from WeLiveSecurity(opens in a new tab)
- New APT group BackdoorDiplomacy attacks diplomats in Africa and the Middle East, ESET Research discovers. (n.d.). Retrieved from ESET(opens in a new tab)
- This new hacking group has a nasty surprise for African, Middle East diplomats. (n.d.). Retrieved from ZDNet(opens in a new tab)