Global warning: Hackers exploit legitimate tools to attack cybersecurity systems

11 minutes ago

2 min read

International cybersecurity agencies have recently issued an important cybersecurity warning regarding a large-scale cyber espionage campaign. According to the advisory, a hacker group linked to the Chinese government is combining wide-scale automated scanning tools with legitimate administration software to infiltrate, maintain persistence, and steal data from numerous organizations globally.

Cybersecurity warning on risks from automated scanning tools

This security advisory was issued based on collaboration between the Australian Cyber Security Centre (ACSC), the U.S. Federal Bureau of Investigation (FBI), CISA, NSA, the UK National Cyber Security Centre, along with partner agencies from Canada, Japan, New Zealand, and Spain. The report focuses on Integrity Technology Group (Integrity Tech) – a China-based enterprise identified as the provider of infrastructure and tools serving cyberattack operations.

Based on evidence collected from multiple investigations, the attack group used open-source scanning software such as Nmap, masscan, and dirsearch, combined with the Python-based MicroScan tool (containing over 1,300 test scripts), to automatically detect vulnerabilities on internet-connected systems.

In addition, the hackers targeted Microsoft Exchange and Microsoft 365 environments. They used the EBurst tool to conduct password spraying, while inserting malicious XSS code to create spoofed login interfaces to hijack user accounts.

"Living off the land" techniques to maintain connection and hide

After bypassing initial defenses, the hacker group applied "Living off the Land" techniques (relying on existing resources). Instead of using unusual malware easily detected by security software, they exploited legitimate administration applications within the victim's systems.

A prime example is the exploitation of SoftEther VPN software to establish remote connection channels. Because SoftEther is a legitimate administrative tool, its activity does not trigger standard security alerts. Hackers configured the software to automatically reconnect, ensuring prolonged access even if the initial intrusion was disrupted.

From this entry point, attackers used scripts to access Microsoft Exchange Web Services to collect emails, contacts, and calendars. Before being exfiltrated, data was compressed or encrypted and renamed to resemble standard web page resources to avoid drawing attention.

Affected targets span multiple sectors, including government agencies, healthcare, manufacturing, information technology, law enforcement, education, and religious organizations in the U.S., Southeast Asia, North America, and Africa.

Defense recommendations and enhanced monitoring

In the face of increasingly hard-to-detect obfuscation methods, security agencies assess that relying solely on firewalls or lists of malicious IP addresses is no longer effective. Organizations must shift to a continuous internal monitoring strategy and proactively hunt for threats.

Recommended technical measures to implement include:

Mandatory implementation of multi-factor authentication (MFA) for all accounts.
Timely application of patches for internet-facing services.
Closely monitoring high-privilege administrative accounts and Active Directory replication processes.
Inspecting abnormal network connections, managing cloud applications with access to sensitive data, and monitoring outbound data traffic.
Reviewing and assessing defense systems against the MITRE ATT&CK reference framework.
Upon detecting signs of compromise, immediately isolating devices, preserving forensic evidence, and taking steps to evict attackers from the system.