Legacy IT infrastructure hosted Chinese spies inside a US engineering firm for months

An illustration of a 1960s spy with sunglasses and a big coat
(Image credit: Shutterstock / rogistok)

Chinese state-sponsored hackers were snooping around a US-based global engineering firm for months, trying to steal classified information, blueprints, login credentials, and other sensitive data.

An exclusive report by The Register, discussed the news with John Dwyer, Director of Security Research at Binary Defense, a managed detection and response firm that was brought in to investigate, once the attack was discovered.

The target company was not named, but it was describes as making, “components for public and private aerospace organizations and other critical sectors, including oil and gas.” The hacking collective was also not precisely identified, although the researchers did say they believed it to be Chinese, and state-sponsored, at that.

Unmanaged IT

The group made its way into the company’s infrastructure through three unmanaged AIX servers. These IBM-made servers are running the Advanced Interactive eXecutive operating system, a UNIX-based OS, and apparently, still had the default login credentials. That allowed threat actors to brute-force their way in, after which they established persistence and lurked for months. The researchers believe the intrusion originally occurred in March this year.

The group’s goal was to harvest information, which could later probably be used in supply chain attacks. Since the organization makes gear for critical sectors, the risk of important hardware going bust was real.

The victim company had endpoint detection and response (EDR) systems set up. However, these AIX servers were so old that they weren’t compatible with the EDR and as such were not monitored. The Register described them as “long- or almost-forgotten machines,” shadow IT deployments that are often not managed at all.

However, when the crooks tried to dump the memory of the LSASS process on a Windows server (a “common way to harvest credentials," the publication states), they were spotted, and blocked.

Via The Register

More from TechRadar Pro

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.

Read more
cybersecurity
Chinese government hackers allegedly spent years undetected in foreign phone networks
China
Chinese hackers develop effective new hacking technique to go after business networks
A computer being guarded by cybersecurity.
Huge cyberattack found hitting vulnerable Microsoft-signed legacy drivers to get past security
A group of 7 hackers, 6 slightly blurred in the background and one in the foreground, all wearing black with hoods pulled up over their heads. You cannot see their faces. The hacker in the foreground sits with an open laptop in front of them. The background, behind the hackers, is a Chinese flag
China government-linked hackers caught running a seriously dangerous ransomware scam
China
US Treasury declares ‘major incident’ after apparent state-sponsored Chinese hack
China
Chinese hackers targeting Juniper Networks routers, so patch now
Latest in Security
Isometric demonstrating multi-factor authentication using a mobile device.
NCSC gets influencers to sing the praises of 2FA
A stylized depiction of a padlocked WiFi symbol sitting in the centre of an interlocking vault.
Dangerous new CoffeeLoader malware executes on your GPU to get past security tools
China
Notorious Chinese hackers FamousSparrow allegedly target US financial firms
A digital representation of a lock
NYU website defaced as hacker leaks info on a million students
NHS
NHS IT supplier hit with major fine following ransomware attack
Businessman holding a magnifier and searching for a hacker within a business team.
Cloud streaming hoster StreamElements confirms data breach following attack
Latest in News
cheap Nintendo Switch game deals sales
Nintendo didn't anticipate that Mario Kart 8 Deluxe was 'going to be the juggernaut' for the Nintendo Switch when it was ported to the console, according to former employees
Three angles of the Apple MacBook Air 15-inch M4 laptop above a desk
Apple MacBook Air 15-inch (M4) review roundup – should you buy Apple's new lightweight laptop?
Witchbrook
Witchbrook, the life-sim I've been waiting years for, finally has a release window and it's sooner than you think
Amazon Echo Smart Speaker
Amazon is experimenting with renaming Echo speakers to Alexa speakers, and it's about time
Shigeru Miyamoto presents Nintendo Today app
Nintendo Today smartphone app is out now on iOS and Android devices – and here's what it does
Nintendo Virtual Game Card
Nintendo reveals the new Virtual Game Card feature, an easier way to manage your digital Switch games