Eight countries have warned about the speed and efficiency of China-based hackers accessing government networks.
Cybersecurity agencies from Australia, the U.S., the U.K., Canada, New Zealand, Germany, the Republic of Korea, and Japan have released a joint advisory warning about the Chinese hacker group APT40, also known as Kryptonite Panda, Gingham Typhoon, Leviathan, and Bronze Mohawk. The group has been targeting government and private sector networks, particularly in Australia and the United States, exploiting vulnerabilities in small-office and home-office devices to launch attacks. APT40 is linked to the Chinese Ministry of State Security.
APT40 has been a persistent threat, relying on outdated and vulnerable infrastructure to conduct its operations. The group's preference for exploiting public-facing infrastructure over user-interaction techniques like phishing has allowed them to infiltrate networks efficiently. They have been particularly effective in exploiting software such as Log4J, Atlassian Confluence, and Microsoft Exchange, with some vulnerabilities dating back to 2017.
Related: Combating phishing in healthcare
"The group appears to prefer exploiting vulnerable, public-facing infrastructure over techniques that require user interaction such as phishing campaigns," said the Australian Signals Directorate (ASD). "Typically, after successful initial access APT40 focuses on establishing persistence to maintain access on the victim’s environment." The U.K.'s National Cyber Security Centre added, "These devices are softer targets when they are not running the latest software, or are no longer supported with security updates."
APT40's activities indicate the importance of maintaining up-to-date software and security patches. Small-office and home-office devices are particularly vulnerable due to their often outdated or unsupported status. Both government and private sector entities must understand these risks to strengthen their cybersecurity defenses.
The efficiency and adaptability of APT40's operations are a significant threat to national security and private sector networks. Their ability to quickly exploit new vulnerabilities and maintain persistent access increases the risk of data breaches and unauthorized access. The warning reinforces the urgent need for robust cybersecurity measures and international cooperation to combat these sophisticated cyber threats.
Related: Preventing the spread of cybersecurity attacks in healthcare
Common threats include ransomware attacks, phishing scams, and data breaches that target sensitive patient information and disrupt healthcare operations.
Organizations can protect against ransomware by implementing regular data backups, employee training on recognizing phishing emails and maintaining up-to-date security software.
Encryption protects sensitive data by converting it into a coded format that is unreadable without a decryption key, ensuring patient information remains confidential during transmission and storage.