Penguin

cross-posted from: https://lemmy.kde.social/post/4886177

Archived/non pay-walled

Here is the original report by Darktrace: Salty Much: Darktrace’s view on a recent Salt Typhoon intrusion

Cybersecurity programs typically focus on protecting core applications and digital assets. But what if the bad guys start targeting trusted defensive measures?

This was the case as reported by Darktrace, a cybersecurity platform provider. Its report sheds light on a sophisticated cyber intrusion linked to Salt Typhoon. The threat actor group is believed to be operated by China's Ministry of State Security, which conducts cyber espionage campaigns against other countries.

The recent attack features a blend of zero-day exploitation and trusted software abuse. In this instance, Salt Typhoon infiltrated a European telecommunications provider through a gateway device. The attackers then executed a familiar—but evolving—arsenal of stealth techniques. These included DLL sideloading and abusing trusted antivirus software—such as Norton, Bkav, and IObit—to mask malicious payloads under legitimate binaries. The campaign also deployed a custom backdoor known as SNAPPYBEE (aka Deed RAT) by using a dual command-and-control channel (HTTP and unidentified TCP) to sustain the covert access.

Darktrace analysts attribute the incident to Salt Typhoon based on overlapping tactics, infrastructure, and malware patterns seen in prior operations by the group. The event underscores a growing trend: nation-state actors are increasingly weaponizing legitimate tools and supply-chain software to bypass traditional security controls and AI-powered detection.

...

Given the current geopolitical relationship between the US and China, attacks like this are sure to keep occurring. The two countries compete in world markets. Plus, mutual distrust exists across economic, technological, and military domains.

This campaign also symbolizes broader China-linked cyber operations targeting telecom and communications infrastructure as part of its strategic intelligence-gathering efforts.

“Organizations should expect stealthy activity that blends with normal operations when facing Salt Typhoon,” said Jason Soroko, a Senior Fellow at Sectigo, a provider of comprehensive certificate lifecycle management.”

As this attack illustrates, there has been a shift toward stealth-driven espionage. Attackers now rely less on malware volume. Their focus has turned to exploiting the trust woven into enterprise systems. The time has arrived to apply the zero-trust paradigm to cybersecurity defenses.

Archived/non pay-walled

Here is the original report by Darktrace: Salty Much: Darktrace’s view on a recent Salt Typhoon intrusion

Cybersecurity programs typically focus on protecting core applications and digital assets. But what if the bad guys start targeting trusted defensive measures?

This was the case as reported by Darktrace, a cybersecurity platform provider. Its report sheds light on a sophisticated cyber intrusion linked to Salt Typhoon. The threat actor group is believed to be operated by China's Ministry of State Security, which conducts cyber espionage campaigns against other countries.

The recent attack features a blend of zero-day exploitation and trusted software abuse. In this instance, Salt Typhoon infiltrated a European telecommunications provider through a gateway device. The attackers then executed a familiar—but evolving—arsenal of stealth techniques. These included DLL sideloading and abusing trusted antivirus software—such as Norton, Bkav, and IObit—to mask malicious payloads under legitimate binaries. The campaign also deployed a custom backdoor known as SNAPPYBEE (aka Deed RAT) by using a dual command-and-control channel (HTTP and unidentified TCP) to sustain the covert access.

Darktrace analysts attribute the incident to Salt Typhoon based on overlapping tactics, infrastructure, and malware patterns seen in prior operations by the group. The event underscores a growing trend: nation-state actors are increasingly weaponizing legitimate tools and supply-chain software to bypass traditional security controls and AI-powered detection.

...

Given the current geopolitical relationship between the US and China, attacks like this are sure to keep occurring. The two countries compete in world markets. Plus, mutual distrust exists across economic, technological, and military domains.

This campaign also symbolizes broader China-linked cyber operations targeting telecom and communications infrastructure as part of its strategic intelligence-gathering efforts.

“Organizations should expect stealthy activity that blends with normal operations when facing Salt Typhoon,” said Jason Soroko, a Senior Fellow at Sectigo, a provider of comprehensive certificate lifecycle management.”

As this attack illustrates, there has been a shift toward stealth-driven espionage. Attackers now rely less on malware volume. Their focus has turned to exploiting the trust woven into enterprise systems. The time has arrived to apply the zero-trust paradigm to cybersecurity defenses.

I am not sure whether this is the right community for this question, so please let me know if it's better to ask somewhere else:

I am getting a message, saying,

The issuer certificate of a locally looked up certificate could not be found.

How do I solve this? (I am running on Debian).

cross-posted from: https://lemmy.kde.social/post/4574561

A French court is to try the Chinese captain of a tanker from Russia's "shadow fleet" early next year after it was intercepted off France, prosecutors said Thursday, in a move seen as a message to Moscow over its efforts to skirt Western oil sanctions.

The French navy on Saturday stopped the Boracay, a vessel claiming to be flagged in Benin and blacklisted by the European Union for being part of Russia's sanction-busting "shadow fleet" of ageing oil tankers, according to the public prosecutor's office in the northwestern city of Brest.

A French court is to try the Chinese captain of a tanker from Russia's "shadow fleet" early next year after it was intercepted off France, prosecutors said Thursday, in a move seen as a message to Moscow over its efforts to skirt Western oil sanctions.

The French navy on Saturday stopped the Boracay, a vessel claiming to be flagged in Benin and blacklisted by the European Union for being part of Russia's sanction-busting "shadow fleet" of ageing oil tankers, according to the public prosecutor's office in the northwestern city of Brest.