According to the findings of Palo Alto Networks researchers, hackers broke into, among others: to five national law enforcement and border services, three ministries of finance and other government agencies responsible for diplomacy, trade and natural resources. Those attacked included institutions such as the Brazilian Ministry of Mines and Energy, the parliament and army of the Czech Republic, a representative of the Indonesian government and a Taiwanese supplier of energy equipment.
What organizations were attacked?
Who is behind the attacks?
What methods did the hackers use?
Were the US and UK affected by the attacks?
Palo Alto Networks did not clearly indicate who was behind the attacks when attributing actions “a group linked to a single country operating from Asia.” However, experts note that the selected strategic goals and interests are reminiscent of previous operations attributed to China.
Methods of operation and scale of attacks
A group of hackers referred to by Palo Alto Networks as TGR-STA-1030, used both classic phishing emails and known security vulnerabilities to gain access to systems. The attacks affected organizations in countries such as Bolivia, Brazil, Mexico, Panama, Venezuela, Cyprus, Greece, Indonesia, Malaysia, Mongolia, Taiwan, Thailand, Democratic Republic of the Congo, Djibouti and Zambia.
Peter Renals, principal security researcher at Palo Alto Networks' Unit 42 threat research team, told Axios that government agencies and organizations responsible for critical infrastructure in the US and UK were not affected by the attacks. Renals emphasized that hackers conduct intensive espionage activities while trying not to draw attention to themselves.
Possibility of further attacks
Researchers from Palo Alto Networks observed that the group has been scanning infrastructure in 155 countries in recent months for security vulnerabilities, which indicates interest in future attacks
The company has contacted 37 affected countries and industry partners, but warns that the hacker group remains active. The report emphasized that “the methods, goals and scale of activities of this group are disturbing and may have long-term consequences for state security and key services.”
