Hackers linked to a Chinese cybersecurity company stole emails from government agencies, law enforcement, healthcare systems, and religious organizations across Southeast Asia, according to a joint advisory released by the FBI and agencies from six other countries.
The threat actors have been targeting networks since at least January 2021. They scan websites for security flaws, exploit known vulnerabilities, and guess passwords to gain access to Microsoft 365 and Exchange accounts.
The advisory lists eight exploited vulnerabilities, including CVE-2019-11510, CVE-2021-22205, and CVE-2023-22894. The flaws affect various software and services, allowing attackers to compromise vulnerable systems.
Once inside a network, the hackers use tools to steal account credentials and maintain access. They also deploy scripts that collect emails, compress the data, and send it to remote servers. Another tool repeatedly accesses Microsoft 365 accounts to collect messages from different time periods.
The campaign has targeted organizations in North America, Africa, and Southeast Asia, including US government agencies, healthcare providers, schools, and critical manufacturing companies. The advisory does not say how many organizations were breached or how many emails were stolen.
Last week, the US authorities seized the Microscan and FishHub vulnerability scanning and spearphishing tools that were allegedly used by Chinese threat actors. Microscan was used to scan computer networks, including critical infrastructure, to find security weaknesses that could later be exploited. FishHub was used to help attackers gain access to networks through phishing, install malware, remotely access systems, and steal files. The tools were reportedly used against organizations in the US, Taiwan, Japan, Poland, and other countries, including power companies, airports, universities, and NGOs.