China-linked actor targets telecoms providers in South America

Cisco Talos has reported on activity from a threat actor tracked as UAT-9244, which researchers assess with high confidence to be linked to the China-associated group Famous Sparrow. The campaign has primarily hit telecoms providers in South America, pointing to an espionage operation aimed at long-term access to critical communications infrastructure. During the intrusions the attackers deployed three previously undocumented implants providing persistent access and remote command execution, with functions for reconnaissance, command and control, and ongoing monitoring of infected hosts.

What this means for your business

State actors going after telecoms are not after money. They want quiet, durable access to the infrastructure other people's communications pass through, and they are patient. For Norwegian critical infrastructure operators, the lesson is that detection must target persistence over time, not just noisy events. If you are a customer of a telecoms provider, this is also an argument for examining what traffic and data actually pass through it.

Berigo recommends

• Ensure logs from network and infrastructure components are retained long enough to investigate months back.
• Hunt for signs of persistence: unexpected services, scheduled tasks and accounts that belong to no project.
• Encrypt data in transit regardless of how much you trust the underlying network provider.
• Add espionage as its own scenario in the response plan, with different success criteria than a ransomware case.

Source

• blog.talosintelligence.com