The Canadian Centre for Cyber Safety and the U.S. Federal Bureau of Investigation (FBI) have issued an advisory warning of cyber assaults mounted by the China-linked Salt Hurricane actors to breach main international telecommunications suppliers as a part of a cyber espionage marketing campaign.
The attackers exploited a essential Cisco IOS XE software program (CVE-2023-20198, CVSS rating: 10.0) to entry configuration recordsdata from three community units registered to a Canadian telecommunications firm in mid-February 2025.
The menace actors are additionally stated to have modified a minimum of one of many recordsdata to configure a Generic Routing Encapsulation (GRE) tunnel, enabling visitors assortment from the community. The title of the focused firm was not disclosed.
Stating that the concentrating on seemingly goes past the telecommunications sector, the businesses stated the concentrating on of Canadian units might allow the menace actors to gather info from the compromised networks and use them as leverage to breach extra units.
“In some circumstances, we assess that the menace actors’ actions have been very seemingly restricted to community reconnaissance,” per the alert.
The businesses additional identified that edge community units proceed to be a lovely goal for Chinese language state-sponsored menace actors trying to breach and keep persistent entry to telecom service suppliers.
The findings dovetail with an earlier report from Recorded Future that detailed the exploitation of CVE-2023-20198 and CVE-2023-20273 to infiltrate telecom and web corporations within the U.S., South Africa, and Italy, and leveraging the footholds to arrange GRE tunnels for long-term entry and information exfiltration.
U.Ok. NCSC Warns of SHOE RACK and UMBRELLA STAND Malware Concentrating on Fortinet Units
The event comes because the U.Ok. Nationwide Cyber Safety Centre (NCSC) revealed two totally different malware households dubbed SHOE RACK and UMBRELLA STAND which have been discovered concentrating on FortiGate 100D collection firewalls made by Fortinet.
Whereas SHOE RACK is a post-exploitation instrument for distant shell entry and TCP tunneling by means of a compromised machine, UMBRELLA STAND is designed to run shell instructions issued from an attacker-controlled server.
Curiously, SHOE RACK is partly based mostly on a publicly accessible instrument named reverse_shell, which, coincidentally, has additionally been repurposed by a China-nexus menace cluster known as PurpleHaze to plan a Home windows implant codenamed GoReShell. It is presently not clear if these actions are associated.
The NCSC stated it recognized some similarities between UMBRELLA STAND and COATHANGER, a backdoor that was beforehand put to make use of by Chinese language state-backed hackers in a cyber assault geared toward a Dutch armed forces community.
