NSA, NCSC, and allies detailed TTPs associated with Chinese APT actors targeting critical infrastructure Orgs

According to the National Security Agency (NSA) and other U.S. and foreign organizations, a joint Cybersecurity Advisory outlines TTPs used by Chinese APT actors, linked to Salt Typhoon, as they target critical infrastructure organisations worldwide, including telecoms, government, transport, lodging, and military sectors. The advisory, published in coordination with the UK’s National Cyber Security Centre (NCSC) and allies, ties activities to entities such as Sichuan Juxinhe Network Technology Co.

Ltd., Beijing Huanyu Tianqiong Information Technology Co., Ltd., and Sichuan Zhixin Ruijie Network Technology Co. Ltd., which provide cyber products and services to China’s security services. It notes that these actors gain initial access by exploiting known CVEs rather than zero-days, listing examples such as CVE-2024-21887, CVE-2024-3400, CVE-2023-20273, CVE-2023-20198 and CVE-2018-0171, and that they pivot through edge devices from vendors including Ivanti, Palo Alto Networks, Cisco, and others.

The report describes their use of VPSs and compromised routers to pivot into networks, alter routing, and establish covert channels via GRE/IPsec tunnels, with persistence achieved by modifying ACLs and abusing SSH or HTTP/HTTPS. It also encourages threat hunting and timely reporting of compromises, noting the aims to feed global espionage through multiple C2 channels.