Skip to main content
عربي
logo

NCSC-TAD-2508-001

Severity Level: Critical
Vulnerability

Reference No.: NCSC-TAD-2508-001CVSS 0

State-Sponsored Actors Target Network Infrastructure for Cyber Espionage

Threat Type:
N/A
TLP:
CLEAR
CVE:
CVE-2024-21887, CVE-2024-3400, CVE-2023-20198, CVE-2023-20273, CVE-2018-0171

Overview

State-sponsored threat actors are compromising network infrastructure to maintain long-term access, collect sensitive information, and conduct cyber espionage.

The attackers exploit known vulnerabilities in routers, firewalls, and VPN appliances. They modify device configurations, create unauthorized accounts, and abuse trusted connections to access additional networks. Traffic mirroring, packet capture, and covert tunnels are used to collect and transfer data while avoiding detection.

Affected Technologies

  • Cisco IOS/IOS XE devices
  • Ivanti Connect Secure and Policy Secure
  • Palo Alto Networks PAN-OS with GlobalProtect

Mitigation and Immediate Actions

  1. 01

    Prioritize patching internet-facing network devices, particularly those affected by known exploited vulnerabilities.

  2. 02

    Review configurations for unauthorized accounts, routing changes, tunnels, traffic mirroring, and authentication settings.

  3. 03

    Investigate unexpected virtual containers and suspicious administrative activity on network devices.

  4. 04

    Disable unused services and unencrypted management protocols, including Telnet, FTP, and HTTP.

  5. 05

    Replace default administrative credentials and use public-key authentication where operationally feasible.

  6. 06

    Centralize logs and alert on unusual administrative access and configuration changes.

  7. 07

    Investigate the full scope of suspected compromise and coordinate remediation to remove all attacker access.

References