The Canadian Centre for Cyber Safety and the U.S. Federal Bureau of Investigation (FBI) have issued an advisory warning of cyber assaults mounted by the China-linked Salt Storm actors to breach main world telecommunications suppliers as a part of a cyber espionage marketing campaign.
The attackers exploited a crucial Cisco IOS XE software program (CVE-2023-20198, CVSS rating: 10.0) to entry configuration recordsdata from three community units registered to a Canadian telecommunications firm in mid-February 2025.
The risk actors are additionally stated to have modified at the very least one of many recordsdata to configure a Generic Routing Encapsulation (GRE) tunnel, enabling site visitors assortment from the community. The title of the focused firm was not disclosed.
Stating that the concentrating on seemingly goes past the telecommunications sector, the companies stated the concentrating on of Canadian units could allow the risk actors to gather data from the compromised networks and use them as leverage to breach extra units.
“In some instances, we assess that the risk actors’ actions have been very seemingly restricted to community reconnaissance,” per the alert.
The companies additional identified that edge community units proceed to be a horny goal for Chinese language state-sponsored risk actors trying to breach and preserve persistent entry to telecom service suppliers.
The findings dovetail with an earlier report from Recorded Future that detailed the exploitation of CVE-2023-20198 and CVE-2023-20273 to infiltrate telecom and web companies within the U.S., South Africa, and Italy, and leveraging the footholds to arrange GRE tunnels for long-term entry and information exfiltration.
U.Ok. NCSC Warns of SHOE RACK and UMBRELLA STAND Malware Focusing on Fortinet Units
The event comes because the U.Ok. Nationwide Cyber Safety Centre (NCSC) revealed two totally different malware households dubbed SHOE RACK and UMBRELLA STAND which have been discovered concentrating on FortiGate 100D collection firewalls made by Fortinet.
Whereas SHOE RACK is a post-exploitation device for distant shell entry and TCP tunneling by way of a compromised system, UMBRELLA STAND is designed to run shell instructions issued from an attacker-controlled server.
Curiously, SHOE RACK is partly primarily based on a publicly accessible device named reverse_shell, which, coincidentally, has additionally been repurposed by a China-nexus risk cluster referred to as PurpleHaze to plan a Home windows implant codenamed GoReShell. It is at the moment not clear if these actions are associated.
The NCSC stated it recognized some similarities between UMBRELLA STAND and COATHANGER, a backdoor that was beforehand put to make use of by Chinese language state-backed hackers in a cyber assault geared toward a Dutch armed forces community.
