The Clop Ransomware Gang Have Struck State, Federal Agencies and Hospitals

Posted on June 15, 2023June 15, 2023 by Denise Simon

It was several days ago that the first reports started to surface and as CISA/FBI issued warnings, the target list/victims continues to expand.

All attributions so far point to an Russian entity with history on this and those attributions do not come from the Federal government but rather outside cyber expert companies across the country.

Clop ransomware gang starts extorting MOVEit data-theft victims source and expanded details

So, anyone remember when President Biden gave a list of entities that were completely off limits to cyber attacks? Remember?

Well it was exactly a year ago this month…

There are 16 critical infrastructure sectors whose assets, systems, and networks, whether physical or virtual, are considered so vital to the United States that their incapacitation or destruction would have a debilitating effect on security, national economic security, national public health or safety, or any combination thereof. Presidential Policy Directive 21 (PPD-21): Critical Infrastructure Security and Resilience advances a national policy to strengthen and maintain secure, functioning, and resilient critical infrastructure. This directive supersedes Homeland Security Presidential Directive 7.

Click here for the full description of the list.

Meanwhile, the victims of this cyber attack related to MoveIT and CLOT include:

Reported by TechTarget:

Illinois, Minnesota and Missouri state governments are among a growing list of organizations attacked via a critical flaw in Progress Software’s MoveIT Transfer product.

Progress Software on May 31 detailed an SQL injection bug in its managed file transfer (MFT) software MoveIt Transfer. Progress urged customers to immediately apply mitigations for the vulnerability, tracked as CVE-2023-34362, while it worked on a patch, which was released later that day. But as security vendors reported soon after, the critical bug was already under active exploitation in the wild.

A wave of organizations have disclosed data breaches in the wake of CVE-2023-34362 coming to light. Some of the early major names affected by the MoveIT flaw included the government of Nova Scotia, Canada; HR software provider Zellis; the BBC; British Airways; and British retailer Boots.

Several other organizations have disclosed compromises since that initial wave, including U.K. broadcast regulator Ofcom and networking vendor Extreme Networks. Multinational accounting firm Ernst and Young was also reportedly breached via the critical flaw. Ernst and Young did not reply to TechTarget Editorial’s request for comment, but the BBC said it received confirmation of a data breach from the firm.

Additionally Johns Hopkins University Hospital got hit as well as British Airlines.

CNN adds information to the report:

A Russian-speaking hacking group known as CLOP last week claimed credit for some of the hacks, which have also affected employees of the BBC, British Airways, oil giant Shell, and state governments in Minnesota and Illinois, among others.

The Russian hackers were the first to exploit the vulnerability, but experts say other groups may now have access to software code needed to conduct attacks.

The ransomware group had given victims until Wednesday to contact them about paying a ransom, after which they began listing more alleged victims from the hack on their extortion site on the dark web. As of Thursday morning, the dark website did not list any US federal agencies.

The episode shows the widespread impact that a single software flaw can have if exploited by skilled criminals.

The hackers – a well-known group whose favored malware emerged in 2019 – in late May began exploiting a new flaw in a widely used file-transfer software known as MOVEit, appearing to target as many exposed organizations as they could. The opportunistic nature of the hack left a broad swath of organizations vulnerable to extortion.

Progress, the US firm that owns the MOVEit software, has also urged victims to update their software packages and has issued security advice.

Does Iran Really Have a Hyper-sonic Missile System?

Posted on June 7, 2023June 7, 2023 by Denise Simon

Primer: Raytheon claims successful innovations for the defense of these missiles.

We’re using our decades of expertise to deliver digitally engineered, end-to-end offensive and defensive technologies to help keep the world safe. And the innovation never stops.

To accelerate hypersonic advances, we partner in creative ways that bring proven technology together with cutting-edge developments in heat management, propulsion and sensing. Teaming across the industry enables us to move advanced hypersonic capabilities out of laboratories, into test environments and into the hands of warfighters at top speed.

The question is what does Saudi Arabia or Israel have for offensive and defensive platforms? No ideas just yet.

only an artist rendering read more here

DUBAI, United Arab Emirates (AP) — Iran claimed on Tuesday that it had created a hypersonic missile capable of traveling at 15 times the speed of sound, adding a new weapon to its arsenal as tensions remain high with the United States over Tehran’s nuclear program.

The new missile — called Fattah, or “Conqueror” in Farsi — was unveiled even as Iran said it would reopen its diplomatic posts on Tuesday in Saudi Arabia after reaching a détente with Riyadh following years of conflict.

The tightly choreographed segment on Iranian state television apparently sought to show that Tehran’s hard-line government can still deploy arms against its enemies across much of the Middle East.

“Today we feel that the deterrent power has been formed,” Iranian President Ebrahim Raisi said at the event. “This power is an anchor of lasting security and peace for the regional countries.”

Gen. Amir Ali Hajizadeh, the head of the paramilitary Revolutionary Guard’s aerospace program, unveiled what appeared to be a model of the missile. Hajizadeh claimed the missile had a range of up to 1,400 kilometers (870 miles).

That’s about mid-range for Iran’s expansive ballistic missile arsenal, which the Guard has built up over the years as Western sanctions largely prevent it from accessing advanced weaponry.

“There exists no system that can rival or counter this missile,” Hajizadeh claimed.

That claim, however, depends on how maneuverable the missile is. Ballistic missiles fly on a trajectory in which anti-missile systems like the Patriot can anticipate their path and intercept them. Tuesday’s event showed what appeared to be a moveable nozzle for the Fattah, which could allow it to change trajectories in flight. The more irregular the missile’s flight path, the more difficult it becomes to intercept.

Iranian officials did not release footage of a Fattah successfully launching and then striking a target. Hajizadeh later said that there had been a ground test of the missile’s engine.

A ground test involves a rocket motor being put on a stand and fired to check its abilities while launching a missile with that rocket motor is much more complex.

Hypersonic weapons, which fly at speeds in excess of Mach 5, or five times the speed of sound, could pose crucial challenges to missile defense systems because of their speed and maneuverability. Iran described the Fattah as being able to reach Mach 15 — which is 15 times the speed of sound.

China is believed to be pursuing the weapons, as is America. Russia claims to already be fielding the weapons and has said it used them on the battlefield in Ukraine. However, speed and maneuverability isn’t a guarantee the missile will successfully strike a target. Ukraine’s air force in May said it shot down a Russian hypersonic Kinzhal missile with a Patriot battery.

Gulf Arab countries allied with the U.S. widely use the Patriot missile system in the region. Israel, Iran’s main rival in the Mideast, also has its own robust air defenses.

In November, Hajizadeh initially claimed that Iran had created a hypersonic missile, without offering evidence to support it. That claim came during the nationwide protests that followed the September death of 22-year-old Mahsa Amini after her arrest by the country’s morality police.

Tuesday’s announcement came as U.S. Secretary of State Antony Blinken is to begin a visit to Saudi Arabia.

___

China Warning to America, Prepare to Live off the Land

Posted on May 25, 2023May 25, 2023 by Denise Simon

It is a major cyber attack discovered by Microsoft. It was discovered while we were all watching that ‘silly spy balloon’ as Biden called it. The attack is called Volt Typhoon, so be on notice America. The Biden White House has said nothing….

Microsoft has uncovered stealthy and targeted malicious activity focused on post-compromise credential access and network system discovery aimed at critical infrastructure organizations in the United States. The attack is carried out by Volt Typhoon, a state-sponsored actor based in China that typically focuses on espionage and information gathering. Microsoft assesses with moderate confidence that this Volt Typhoon campaign is pursuing development of capabilities that could disrupt critical communications infrastructure between the United States and Asia region during future crises.

Volt Typhoon has been active since mid-2021 and has targeted critical infrastructure organizations in Guam and elsewhere in the United States. In this campaign, the affected organizations span the communications, manufacturing, utility, transportation, construction, maritime, government, information technology, and education sectors. Observed behavior suggests that the threat actor intends to perform espionage and maintain access without being detected for as long as possible.

To achieve their objective, the threat actor puts strong emphasis on stealth in this campaign, relying almost exclusively on living-off-the-land techniques and hands-on-keyboard activity. They issue commands via the command line to (1) collect data, including credentials from local and network systems, (2) put the data into an archive file to stage it for exfiltration, and then (3) use the stolen valid credentials to maintain persistence.

***

Dark Reading in part published the following:

China-sponsored threat actors have managed to establish persistent access within telecom networks and other critical infrastructure targets in the US, with the observed purpose of espionage — and, potentially, the ability down the line to disrupt communications in the event of military conflict in the South China Sea and broader Pacific.

The first signs of compromise emerged in telecom networks in Guam, according to a New York Times report ahead of the findings being released. The National Security Agency discovered those intrusions around the same time that the Chinese spy balloon was making headlines for entering US airspace, according to the report. It then enlisted Microsoft to further investigate, eventually uncovering a widespread web of compromises across multiple sectors, with a particular focus on air, communications, maritime, and land transportation targets.

A Shadow Goal? Laying Groundwork for Disruption

The discovery of the activity is playing out against the backdrop of the US’ frosty relations with Beijing; the two superpowers have stalled in their diplomacy since the shooting down of the balloon, and has worsened amidst fears that Russia’s invasion of Ukraine could spur China to do the same in Taiwan.

In the event of a military crisis, a destructive cyberattack on US critical infrastructure could disrupt communications and hamper the country’s ability to come to Taiwan’s aid, the Times report pointed out. Or, according to John Hultquist, chief analyst at Mandiant Intelligence – Google Cloud, a disruptive attack could be used as a proxy for kinetic action.

“These operations are aggressive and potentially dangerous, but they don’t necessarily indicate attacks are looming,” he said in an emailed statement. “A far more reliable indicator for [a] destructive and disruptive cyberattack is a deteriorating geopolitical situation. A destructive and disruptive cyberattack is not just a wartime scenario either. This capability may be used by states looking for alternatives to armed conflict.”

Anderson Air Foce Base/source

Dubbing such preparations “contingency intrusions,” he added that China is certainly not alone in conducting them — although notably, China-backed APTs are typically far more focused on cyber espionage than destruction.

“Over the last decade, Russia has targeted a variety of critical infrastructure sectors in operations that we do not believe were designed for immediate effect,” Hultquist noted. “Chinese cyber threat actors are unique among their peers in that they have not regularly resorted to destructive and disruptive cyberattacks. As a result, their capability is quite opaque.”

An Observed Focus on Stealth & Spying

To achieve initial access, Volt Typhoon compromises Internet-facing Fortinet FortiGuard devices, a popular target for cyberattackers of all stripes (Microsoft is still examining how they’re being breached in this case). Once inside the box, the APT uses the device’s privileges to extract credentials from Active Directory account and authenticate to other devices on the network. Read more here.

Officials Confirm Chinese Balloon Collected Intelligence from Several Sensitive Sites

Posted on April 3, 2023April 3, 2023 by Denise Simon

The administration came out with several lies abut the balloon and continued to claim it had limited value to the Chinese. Chairman of the Joint Chiefs additionally along with other military officials provided China with off-ramps stating the balloon had a glitch and went astray and further told the White House not to shoot it down due to the potential debris field. The Pentagon assessed that the balloon uncovering important information was not great. Even more terrifying is what China has planned with the intelligence gathered and what other rogue/enemy nations have access.

A balloon flies in the sky over Billings, Montana, US, February 1, 2023 in this picture obtained from social media. (Chase Doak/via Reuters)

Now, April 3, 2023, NBC has officially reported some truths.

The Chinese spy balloon that flew across the U.S. was able to gather intelligence from several sensitive American military sites, despite the Biden administration’s efforts to block it from doing so, according to two current senior U.S. officials and one former senior administration official.

China was able to control the balloon so it could make multiple passes over some of the sites (at times flying figure eight formations) and transmit the information it collected back to Beijing in real time, the three officials said. The intelligence China collected was mostly from electronic signals, which can be picked up from weapons systems or include communications from base personnel, rather than images, the officials said.

The three officials said China could have gathered much more intelligence from sensitive sites if not for the administration’s efforts to move around potential targets and obscure the balloon’s ability to pick up their electronic signals by stopping them from broadcasting or emitting signals.

The National Security Council referred NBC News to the Defense Department for comment. The Defense Department directed NBC News to comments from February in which senior officials said the balloon had “limited additive value” for intelligence collection by the Chinese government “over and above what [China] is likely able to collect through things like satellites in low earth orbit.”

China has said repeatedly that the balloon was an unmanned civilian airship that accidentally strayed off course, and that the U.S. overreacted by shooting it down. Officials have not said which company, department or organization the balloon belonged to, despite several requests for comment by NBC News.

After the balloon was shot down in February, Biden administration officials said it was capable of collecting signals intelligence.

The balloon had a self-destruct mechanism that could have been activated remotely by China, but the officials said it’s not clear if that didn’t happen because the mechanism malfunctioned or because China decided not to trigger it.

The balloon first entered U.S. airspace over Alaska on Jan. 28, according to the Biden administration, which said it was tracking it as it moved. Within the next four days, the balloon was flying over Montana — specifically Malmstrom Air Force Base, where the U.S. stores some of its nuclear assets.

The real damage assessment at this point cannot be measured but clearly China spied successfully and will heads roll? Nah…

Meet Zhe Wu and His Low Orbit Balloon Program

Posted on February 13, 2023February 13, 2023 by Denise Simon

It went with almost zero attention that between our US Commerce Department added a handful of companies to a so-called Entity List last week, restricting them from obtaining US technologies in a move blasted by Beijing on Monday as “illegal unilateral sanctions”, almost as soon as the first balloon was shot out of the sky off the coast of South Carolina. Now, just exactly how did our officials know to do that so fast? Now we have to wonder why Treasury has not done the same.

At least someone was paying attention and knew of Zhe Wu and his work…yet no other part of any Federal agency or any part of the military was on their game for the last several years?

Okay…sounds about right.

Beijing Nanjiang Aerospace Technology

Established in 2015, Beijing Nanjiang is controlled by a subsidiary of Shanghai-listed real estate company Deluxe Family Co Ltd, which also invests in materials and robotics projects.

The state-run Science and Technology Daily in 2015 hailed the firm’s development of a large silver helium airship as the country’s first “new near-space platform with capabilities for both military and surveillance use”.

State media said the company’s steerable, reusable and continuously powered airship was equipped with broadband communications and “high-definition observation” gear.

China Electronics Technology Group Corporation 48th Research Institute

Part of a state-owned IT giant, the research institute specialises in building power systems and solar energy components, as well as semiconductor equipment.

The institute has worked to develop flexible solar power cells suitable for both military and civilian aircraft, the China National Space Administration said in a document in 2017.

Parent company China Electronics Technology Group Corporation also funds Hikvision, a surveillance camera maker that has been implicated in intensified monitoring of the Uyghur minority in Xinjiang.

Eagles Men Aviation Science and Technology Group Co

Founded by military aircraft expert Wu Zhe, the group specialises in research and development of stealth aircraft technologies.

Eagles Men is “devoted to becoming a benchmark business for China’s (strategy of) military-civil fusion”, according to the company’s profile page on the official Chinese Society of Aeronautics and Astronautics website.

The company in 2013 filed a patent for making airship skins stronger.

Wu told state media in 2019 that his team had developed a stratospheric airship able to “fly around the globe”.

Dongguan Lingkong Remote Sensing Technology Co

Set up in 2019, the company counts among its investors a branch of the state-run Beihang University, as well as Eagles Men Aviation.

Public records show Dongguan Lingkong has received licences from local market supervisors to conduct research on remote sensing technology, which allows aircraft to detect conditions on the ground from a high altitude.

Guangzhou Tian-Hai-Xiang Aviation Technology Co

The company was originally established by the Chinese military to develop “vehicle-mounted unmanned reconnaissance aircraft”, according to its official website.

Specialising in surveillance drones, the company was reorganised in 2006 with its current name and under the control of military veteran Li Yuzhuang.

Tian-Hai-Xiang says it has received multiple defence science awards, with its website boasting that the company was “the first unit in the domestic drone industry to equip our military’s first digitalised troops”.

Shanxi Eagles Men Aviation Science and Technology Group Co

A wholly owned subsidiary of Eagles Men Aviation, the company was set up in 2012 with a focus on chemical products, according to Chinese business database Tianyancha.

As report in part from The Wire:

On an October morning in 2007, Wu Zhe, an aircraft design expert at Beihang University, gave a lecture about the “military value of balloons.” He described why it was an area of key scientific research for China and explained different solutions for powering these unique aircraft. When he concluded, according to a university press release, his “erudite knowledge and brilliant speech” received multiple rounds of applause.

Nearly two decades later, Wu and his business partner, a tech investor and executive named Wang Dong, are at the center of a military-linked program that has sent balloons over the U.S. and other nations, setting off a diplomatic crisis in Washington. After days of intense media coverage, on February 4, the U.S. shot down one Chinese balloon off the coast of South Carolina, and has since shot down three more unidentified objects floating in American and Canadian airspace.

On Friday, the Commerce Department announced that they were leveling sanctions against six Chinese companies involved in the balloon program — which U.S. officials say aims to intercept communications and surveil the ground below, including sensitive military sites.

Records show that Wu and Wang are linked to four of the six sanctioned firms. The two men, according to data from WireScreen, have a complex network of companies involved in balloon and aerospace technologies, some of which are closely affiliated with the Chinese military but are not sanctioned by the U.S. government.

In a statement on Friday about the sanctions, Alan F. Estevez, the under secretary of commerce for industry and security, said that “today’s action makes clear that entities that seek to harm U.S. national security and sovereignty will be cut off from accessing U.S. technologies.” Neither of the two Chinese men, through their companies, responded to requests for comment.

Zhe Wu has published at least 23 scholarly papers of his work and they are found here..quite chilling actually. For instance: (note the date)

Hovering control for a stratospheric airship in unknown wind

Zewei ZhengMing ZhuDalong ShiZhe Wu
Engineering
13 January 2014

A novel hovering control methodology for a stratospheric airship is presented by using path following approach in the presence of unknown wind by expressing the wind field in the state equation, which avoids the difficulty of guaranteeing system stability in strong wind for other stabilization methods.

The New York Times too published a very recent piece with further context.

In late 2022,

noted –>

Mystery airship spotted over Philippines near South China Sea

Images of an unidentified craft near Subic Bay have sparked speculation it could have been collecting military intelligence

There is no evidence the airship was from China, though its design appears similar to types on display at the Zhuhai air show

Images of the stratospheric airship – allegedly taken in Pangasinan province, about 100km (62 miles) from Subic Bay in the northern Philippine island of Luzon – were first posted on Facebook last weekend. The pictures were deleted, but not before they were also shared on Twitter.

There is no evidence that the airship was from China, although its design appears to be similar to several unmanned types developed by the state-owned Aviation Industry Corporation of China’s Special Aircraft Research Institute and other scientific academies.

The we hear that the objects in the airspace of North America were cylindrical.

Could it be? Below reported from Poland in reference to the same object.

I have asked several out there smarter than me about the connection of the objects with clustered ground hubs..or if ground hubs were dropped by the balloon or objects….I did not need an answer.. Seems there are several that have the answers and we are collaborating AGAIN with China?

An Observation Scheduling Approach Based on Task Clustering for High-Altitude Airship

by Jiawei Chen, Oizhang Luo and Guohua Wu.

School of Computational Science and Engineering, Georgia Institute of Technology, Atlanta, GA 30332, USA

School of Traffic & Transportation Engineering, Central South University, Changsha 410075, China

Department of Electrical & Computer Engineering, National University of Singapore, Singapore 119260, Singapore

You but the judge….