1 MONGOLIA-CHINA AGREE TO COLLABORATE IN INCREASING MEAT EXPORT WWW.MONTSAME.MN PUBLISHED:2018/09/21      2 U.S. AND MONGOLIA SEEK TO STRENGTHEN ECONOMIC RELATIONSHIP WWW.STRTRADE.COM PUBLISHED:2018/09/21      3 MONGOLIA, U.S. LEADERS DISCUSS BILATERAL TIES WWW.XINHUANET.COM PUBLISHED:2018/09/21      4 BELT AND ROAD SIGNIFICANT TO MONGOLIA, PEOPLE AROUND WORLD -- ACADEMIC WWW.ENG.YIDAIYILU.GOV.CN PUBLISHED:2018/09/21      5 PETRO MATAD UPDATES MONGOLIA EXPLORATION WWW.OGJ.COM PUBLISHED:2018/09/21      6 RIO TINTO’S EXIT FROM COAL PAYS OFF, TO RETURN $3.2B FROM SALES PROCEEDS TO SHAREHOLDERS WWW.MINING.COM PUBLISHED:2018/09/21      7 OPENING CEREMONY OF SAINSHAND SALKHIN PARK HELD WWW.MONTSAME.MN PUBLISHED:2018/09/21      8 ALIBABA’S MA SAYS TRUMP’S TRADE WAR ‘DESTROYED’ HIS PROMISE TO CREATE JOBS FOR 1MN AMERICANS WWW.RT.COM  PUBLISHED:2018/09/21      9 LEGAL DISPUTE OVER EMC OWNERSHIP COMES TO AN END WWW.ZGM.MN PUBLISHED:2018/09/20      10 ERDENES TAVAN TOLGOI REVENUE SURGES DUE TO HIGHER COAL PRICES WWW.NEWS.MN PUBLISHED:2018/09/20      НУРАХ ДӨХСӨН БАЙРУУДЫГ ШИНЭЧЛЭХ КОМПАНИ ОЛДОХГҮЙ БАЙНА WWW.ZGM.MN НИЙТЭЛСЭН:2018/09/21     МОНГОЛ УЛС ВАШИНГТОН, ПЁНЬЯНЫ ХЭЛЭЛЦЭЭРТ ЗУУЧЛАХАД БЭЛЭН ГЭДГЭЭ ЗАРЛАЛАА WWW.EAGLE.MN НИЙТЭЛСЭН:2018/09/21     УЛСЫН ХЭМЖЭЭНД 85.3 МЯНГАН ТОНН ТӨМС ХУРААН АВААД БАЙНА WWW.MONTSAME.MN НИЙТЭЛСЭН:2018/09/21     ЗГ: БУЦАЛТГҮЙ ТУСЛАМЖИЙГ УСНЫ НӨӨЦИЙГ САЙЖРУУЛАХ, ХЭРЭГЛЭСЭН УСЫГ БУЦААН АШИГЛАХАД ЗАРЦУУЛНА WWW.BLOOMBERGTV.MN НИЙТЭЛСЭН:2018/09/21     ҮСХ: УЛААНБААТАРТ АЖИЛЛАГЧДЫН САРЫН ДУНДАЖ ЦАЛИН УЛСЫН ДУНДЖААС 121.7 МЯНГАН ТӨГРӨГӨӨР ИХ БАЙНА WWW.BLOOMBERGTV.MN НИЙТЭЛСЭН:2018/09/21     МОНГОЛ УЛСЫН ИХ ХУРАЛ, ЕВРОПЫН ПАРЛАМЕНТ ХООРОНДЫН XII УУЛЗАЛТААР ХАМТАРСАН МЭДЭГДЭЛ ГАРГАЛАА WWW.DNN.MN НИЙТЭЛСЭН:2018/09/21     ТӨРИЙН АЛБАНЫ УДИРДАХ АЖИЛТНЫ УЛСЫН ЗӨВЛӨГӨӨН БОЛЖ БАЙНА WWW.UNUUDUR.MN НИЙТЭЛСЭН:2018/09/21     2019 ОНЫГ МОНГОЛ, АМЕРИКИЙН ЗАЛУУЧУУДЫН ЖИЛ БОЛГОНО WWW.EAGLE.MN НИЙТЭЛСЭН:2018/09/21     УУРХАЙЧДЫН АЖЛЫН БАЙР НЭМЭГДЭЖ, ЦАЛИН ӨСЧ БАЙНА WWW.GOGO.MN НИЙТЭЛСЭН:2018/09/20     “ЭРДЭНЭТ”-ИЙН 49 ХУВИЙН ӨМЧЛӨЛ ТОЙРСОН ХУУЛЬ ЗҮЙН МАРГААН ЭЦЭС БОЛЛОО WWW.ZGM.MN НИЙТЭЛСЭН:2018/09/20    

#1218166: This Chinese hacking group pwned a bunch of Mongolian government sites www.brica.de

A Chinese hacking group broke into a national data center in Mongolia late last year in an expansive cyber-espionage campaign that allowed the attackers to quietly plant malware into government websites, according to a new research report by Kaspersky Lab and supplemental analysis provided to CyberScoop.

According to Kaspersky’s latest research, a known Chinese hacking group used watering hole-style attacks and spear phishing emails to breach specific employees of the Mongolian data center. After gaining individual access, they leveraged those accounts to gain additional control over the facility’s infrastructure.

The episode began around October 2017. It was discovered by Kaspersky in March 2018. The Chinese speaking group that’s responsible is widely linked to Beijing. It’s tracked by the cybersecurity community under different names, including APT27, EmissaryPanda, IronPanda and LuckyMouse. They’ve been known to also target U.S. defense contractors.

The Kaspersky report does not list Mongolia as the victim, but instead refers to it more ambiguously as a “Central Asia” country. A source familiar with the report revealed that country as Mongolia. The person spoke to CyberScoop on condition of anonymity to offer insight that the company chose not to publish.

In the past, APT27 has been tied to both government spying and financial crime, including bitcoin mining efforts. There are other cases where Chinese government-backed hacking groups appeared to be double-dipping; making money on the side while also conducting traditional intelligence missions.

It’s rare to see hackers breach an entire national data center though, especially to this degree.

“The most unusual and interesting point here is the target. A national data center is a valuable source of data that can also be abused to compromise official websites,” Kaspersky senior security researcher Denis Legezo wrote.

The purpose of hacking this data center was to compromise a “wide range of [Mongolian] government resources at one fell swoop.” Some websites hosted by the data center were then injected with malicious JavaScript code, which would cause people who visited the domains to also be potentially infected.

In some cases, compromised machines also received a remote access trojan (RAT) known as “HyperBro,” which provided customized controls to further manipulate or steal secrets from systems.

“There were traces of HyperBro in the infected data center from mid-November 2017. Shortly after that different users in the country started being redirected to the malicious domain update.iaacstudio[.]com as a result of the waterholing of government websites,” a Kaspersky blog post reads. “These events suggest that the data center infected with HyperBro and the waterholing campaign are connected.”

Researchers found that the attack server behind these Mongolian government breaches was mysteriously located in Ukraine. More specifically, the command and control (C2) could be tied back to a hacked Mikrotik router running old firmware. The hackers likely leveraged this Ukrainian machine in order to obfuscate their activities. It’s not yet clear how the hackers owned the Mikrotik router.

Multiple critical vulnerabilities in Mikrotik systems have been reported in recent months.

Historically, Mongolia and China maintain a complicated relationship.

China is one of Mongolia’s biggest trade partners and regional allies; almost 90 percent of Mongolia’s exports go to China, according to one study. But Beijing is also known for its persecution of ethnic and religious minorities, including buddhists, muslims, shamanists and others. Buddhism is the most prevalent religion in Mongolia.

In late 2017, around same the time that APT27 breached the aforementioned government data center, Chinese President Xi Jinping had just won re-election. Months earlier, Mongolia also had an election where their current President Khaltmaa Battulga dominated by riding a populist wave driven by anti-China rhetoric. At the time, some foreign policy experts predicted that Mongolia would shift their economic dependence towards Russia.

More info: https://www.cyberscoop.com/apt27-mongolia-kaspersky/



Published Date:2018-06-18