The Netherlands' Military Intelligence and Security Service (MIVD) claims that Chinese hackers involved in cyber espionage breached the Dutch Ministry of Defense last year and installed malware on its systems.
The good news is that the damage was limited thanks to segmentation network, so the infection couldn't spread everywhere.
“ The victim network had fewer than 50 users. Its purpose was research and development (R&D) unclassified projects and cooperation with two research institutes. These organizations have been informed of the incident ,” the Dutch agency reports
See also: Chinese hackers exploit zero-day vulnerabilities in VPNs
Infection with RAT malware
During the investigation, an unknown malware called Coathanger. It is a remote access (RAT) that infects Fortigate network security appliances.
“Specifically, the COATHANGER implant offers persistence and appears after every reboot by inserting a backup of itself into the process responsible for rebooting the system. Furthermore, the infection survives firmware upgrades,” the Dutch agency warned.
“Therefore, even fully patched FortiGate devices can be infectedif they were compromised before the latest patch was applied.“.
The malware effectively hides and operates underground, intercepting system calls to avoid detection. And as we said, it manages to remain on the network through reboots and firmware upgrades.
See also: Cisco Identity Intelligence: New security solution against hackers
The Dutch Military Intelligence Service has not attributed the attacks to a specific cybercriminal group, but believes they are state-backed Chinese hackers targeting political espionage of the Netherlands and its allies.
FortiGate firewalls targeted by hackers
Chinese hackers developed the Coathanger malware to infect vulnerable FortiGate firewalls, using the CVE-2022-42475. This vulnerability was previously used as a zero-day to target government organizations.
These attacks also share many similarities with another Chinese hacking campaign that targeted unpatched SonicWall Secure Mobile Access (SMA) devices.
Organizations are urged to immediately implement security released by vendors to stay safe.
"For the first time, the MIVD has chosen to make public a technical report on the working methods of Chinese hackers. It is important to attribute such espionage activities to China," said Dutch Defense Minister Kajsa Ollongren.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
See also: ResumeLooters hackers stole millions of data via SQL injection, XSS attacks
Following the breach by Chinese hackers, the Dutch Ministry of Defense must take strict measures to strengthen its cybersecurity (if it has not already done so). First, it is important to strengthen its capabilities to detect and respond to breach incidentsby investing in advanced security systems and monitoring tools.
Furthermore, training its staff on cybersecurity issues, with the aim of increasing awareness and understanding of threats and ways to address them, is essential.
The Ministry of Defense can also strengthen its cooperation with other national and international bodies for the exchange of information and the joint response to cyber threats.
Finally, it is important to implement policies to regularly update and review security protocols, in order to ensure that the measures taken remain current and effective in the evolving world of cybersecurity.
Source: www.bleepingcomputer.com
