1 US TRADE WAR COULD COST GLOBAL ECONOMY $430 BILLION, IMF WARNS WWW.RT.COM PUBLISHED:2018/07/18      2 US PLANS G7 TALKS ON CHINA WWW.NHK.OR.JP PUBLISHED:2018/07/18      3 GOOGLE HIT WITH RECORD EU FINE OVER SHOPPING SERVICE WWW.BBC.COM PUBLISHED:2018/07/18      4 TURQUOISE HILL ANNOUNCES SECOND QUARTER 2018 PRODUCTION AND COMPLETION OF SHAFT 5 WWW.GOGO.MN PUBLISHED:2018/07/18      5 DEVELOPMENT OF BILL ON CIVIL SERVANT CODE OF CONDUCT FINALIZED WWW.GOGO.MN PUBLISHED:2018/07/18      6 CRUDE OIL EXPORTS GENERATED 94.3 BILLION WWW.GOGO.MN PUBLISHED:2018/07/18      7 MONGOLIAN PRESIDENT SUMMONS IRREGULAR PARLIAMENTARY SESSION WWW.NEWS.MN PUBLISHED:2018/07/18      8 JEFF BEZOS IS NOW WORTH MORE THAN BILL GATES AND LARRY PAGE COMBINED WWW.CNN.COM PUBLISHED:2018/07/17      9 APARTMENT COMPLEX FOR YOUNG FAMILIES UNDER CONSTRUCTION IN ERDENET WWW.MONTSAME.MN PUBLISHED:2018/07/17      10 NUM GRADUATES INVITED TO WORK FOR TOSHIBA CORPORATION WWW.MONTSAME.MN PUBLISHED:2018/07/17      ОЛОН УЛСЫН ИННОВАЦИЙН ИНДЕКСЭЭР МОНГОЛ УЛС 53-Т ЖАГСЧЭЭ WWW.MONTSAME.MN НИЙТЭЛСЭН:2018/07/17     ШАДАР САЙД НҮБ-ЫН ӨНДӨР ТҮВШНИЙ УУЛЗАЛТАД ОРОЛЦОЖ БАЙНА WWW.EAGLE.MN НИЙТЭЛСЭН:2018/07/17     "ТАВАНТОЛГОЙ"-Н ТӨМӨР ЗАМЫН ТӨСӨЛ УРАГШЛАХ ЭСЭХ НЬ SHENHUA-ГААС ШАЛТГААЛАХААР БАЙНА WWW.ZGM.MN НИЙТЭЛСЭН:2018/07/17     ХӨШИГИЙН ХӨНДИЙН НИСЭХ БУУДАЛД 5.3 ТЭРБУМ ТӨГРӨГИЙН ҮНЭ БҮХИЙ ЦАЦРАГИЙН ХЯНАЛТЫН ТӨХӨӨРӨМЖ СУУРИЛУУЛНА WWW.DNN.MN НИЙТЭЛСЭН:2018/07/17     2017 ОНЫ САНХҮҮГИЙН НЭГДСЭН ТАЙЛАН ЗӨРЧИЛГҮЙ ДҮГНЭГДЛЭЭ WWW.NEWS.MN НИЙТЭЛСЭН:2018/07/17     2018 ОНЫ ЭХНИЙ ХАГАСТ ХЯТАДЫН ДНБ 6,8 ХУВИАР ӨСЧЭЭ WWW.GOGO.MN НИЙТЭЛСЭН:2018/07/17     МОНГОЛ УЛС ЯПОН УЛСАД 100 МЯНГАН АМ.ДОЛЛАРЫН ХҮМҮҮНЛЭГИЙН ТУСЛАМЖ ҮЗҮҮЛЭХЭЭР БОЛЛОО WWW.GOGO.MN НИЙТЭЛСЭН:2018/07/17     ОУВС-ГААС МАНАЙ УЛС 184.5 САЯ ДОЛЛАРЫН САНХҮҮЖИЛТ АВААД БАЙНА WWW.EAGLE.MN НИЙТЭЛСЭН:2018/07/17     МАНАЙ УЛСЫН ЗЭЭЛЖИХ ЗЭРЭГЛЭЛ ДЭЭШИЛЖЭЭ WWW.EAGLE.MN НИЙТЭЛСЭН:2018/07/16     “ЭРДЭНЭС-ТАВАНТОЛГОЙ” 40 САЯ ДАХЬ ТОНН НҮҮРСЭЭ ОЛБОРЛОЖЭЭ WWW.NEWS.MN  НИЙТЭЛСЭН:2018/07/16    

#1218166: This Chinese hacking group pwned a bunch of Mongolian government sites www.brica.de

A Chinese hacking group broke into a national data center in Mongolia late last year in an expansive cyber-espionage campaign that allowed the attackers to quietly plant malware into government websites, according to a new research report by Kaspersky Lab and supplemental analysis provided to CyberScoop.

According to Kaspersky’s latest research, a known Chinese hacking group used watering hole-style attacks and spear phishing emails to breach specific employees of the Mongolian data center. After gaining individual access, they leveraged those accounts to gain additional control over the facility’s infrastructure.

The episode began around October 2017. It was discovered by Kaspersky in March 2018. The Chinese speaking group that’s responsible is widely linked to Beijing. It’s tracked by the cybersecurity community under different names, including APT27, EmissaryPanda, IronPanda and LuckyMouse. They’ve been known to also target U.S. defense contractors.

The Kaspersky report does not list Mongolia as the victim, but instead refers to it more ambiguously as a “Central Asia” country. A source familiar with the report revealed that country as Mongolia. The person spoke to CyberScoop on condition of anonymity to offer insight that the company chose not to publish.

In the past, APT27 has been tied to both government spying and financial crime, including bitcoin mining efforts. There are other cases where Chinese government-backed hacking groups appeared to be double-dipping; making money on the side while also conducting traditional intelligence missions.

It’s rare to see hackers breach an entire national data center though, especially to this degree.

“The most unusual and interesting point here is the target. A national data center is a valuable source of data that can also be abused to compromise official websites,” Kaspersky senior security researcher Denis Legezo wrote.

The purpose of hacking this data center was to compromise a “wide range of [Mongolian] government resources at one fell swoop.” Some websites hosted by the data center were then injected with malicious JavaScript code, which would cause people who visited the domains to also be potentially infected.

In some cases, compromised machines also received a remote access trojan (RAT) known as “HyperBro,” which provided customized controls to further manipulate or steal secrets from systems.

“There were traces of HyperBro in the infected data center from mid-November 2017. Shortly after that different users in the country started being redirected to the malicious domain update.iaacstudio[.]com as a result of the waterholing of government websites,” a Kaspersky blog post reads. “These events suggest that the data center infected with HyperBro and the waterholing campaign are connected.”

Researchers found that the attack server behind these Mongolian government breaches was mysteriously located in Ukraine. More specifically, the command and control (C2) could be tied back to a hacked Mikrotik router running old firmware. The hackers likely leveraged this Ukrainian machine in order to obfuscate their activities. It’s not yet clear how the hackers owned the Mikrotik router.

Multiple critical vulnerabilities in Mikrotik systems have been reported in recent months.

Historically, Mongolia and China maintain a complicated relationship.

China is one of Mongolia’s biggest trade partners and regional allies; almost 90 percent of Mongolia’s exports go to China, according to one study. But Beijing is also known for its persecution of ethnic and religious minorities, including buddhists, muslims, shamanists and others. Buddhism is the most prevalent religion in Mongolia.

In late 2017, around same the time that APT27 breached the aforementioned government data center, Chinese President Xi Jinping had just won re-election. Months earlier, Mongolia also had an election where their current President Khaltmaa Battulga dominated by riding a populist wave driven by anti-China rhetoric. At the time, some foreign policy experts predicted that Mongolia would shift their economic dependence towards Russia.

More info: https://www.cyberscoop.com/apt27-mongolia-kaspersky/



Published Date:2018-06-18