Chinese APT Hackers Used Log4Shell Exploit To Target Academic Institution

Promotion

Chinese state-sponsored group Aquatic Panda recently attacked an important, unnamed educational institution by exploiting the major flaw in the Apache Log4Shell logging library. According to the local sources, the intrusion adversary, Aquatic Panda, conducted multiple post-exploitation operations. The attack ended up being unsuccessful.

The primary goal of the attackers is still unclear, and we don’t know what they were trying to achieve by infiltrating the system of this educational institution.

According to the institution's representatives, the group did manage to conduct reconnaissance and credential harvesting in their system. Aquatic Panda also attempted to stop third-party endpoint detection response services and wanted to retrieve next-stage payloads and harvest credentials.

Aquatic Panda is said to have become active in the mid-2020. The state-backed group’s general goals include intelligence collection through methods used in this particular attack. They also specialize in industrial espionage and typically target companies that deal with the government sector, telecommunications, and technology in general. Attacks that exploit such vulnerabilities have become more common, which should alert all institutions to up their security game and be on high alert for potential attacks similar to one orchestrated by the Aquatic Panda. 

According to the representatives from the educational institution that became the target of the Chinese state-backed attack group, the institution was able to react promptly. Soon after getting the information about the attack, the institution quickly implemented its incident response protocol and managed to detect and then patch up the vulnerability. 

But not all organizations or institutions manage to get away unscathed by similar attacks. While we know that the hackers couldn't compromise the institution’s system, we’ve seen other cases where attacks like these ended up taking down entire corporations. This is why it is so important to have strong preventative measures in place. It is much easier to invest a bit more in protection than to try and save the situation once the attackers have located the vulnerabilities in your systems. 

Here are some specific steps you can take to ensure your security online and avoid getting entangled with hacker groups like Aquatic Panda.

Use a VPN When Browsing Online

Virtual Private Networks (VPNs) reroute your network connection through a secure tunnel and connect it to a remote server that cannot be traced back to you. When we browse the web without being connected to the VPN, our IP address and other personal information are extremely easy for a stranger to access. Neglecting the privacy of our personal details is a very risky approach and could lead to serious threats to our privacy, finances, and even our well-being. Protect your identity online and use a VPN (https://nordvpn.com/download/) to browse the web safely and anonymously. 

Install Antivirus

Antivirus is a great online security investment to make - an effective preventative tool that alerts the user as soon as it detects any suspicious activity or malware in the system. These days there are plenty of options for those who want to purchase a good antivirus. They vary in price as well as what they can do for your online privacy. Simple research online will direct you towards the antivirus that is right for you. 

There are many benefits to doing things online and moving towards a more digitized society. Attacks like those orchestrated by Aquatic Panda are sadly a part of this development. Lucky for us, many tools can help us prevent similar attacks from getting out of hand.

It’s always wise to invest more in prevention than to start searching for a quick fix after the attack. The latter approach will probably cost you more in the end anyway. Use the tools mentioned here to protect yourself online.

Staying cautious will help keep your privacy without giving up all the conveniences of modern technology.

Contributed by Ulrike Niemann: Cyber security enthusiast, freelance copywriter, content marketing manager.

You Might Also Read: 

Log4j Cyber Security Flaw Seriously Concerns Experts:

 

« Europol Is Told To Delete Its 'Big Data Ark'
Is Cyber Training Fit For Purpose? »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

ZenGRC

ZenGRC

ZenGRC (formerly Reciprocity) is a leader in the GRC SaaS landscape, offering robust and intuitive products designed to make compliance straightforward and efficient.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

The PC Support Group

The PC Support Group

A partnership with The PC Support Group delivers improved productivity, reduced costs and protects your business through exceptional IT, telecoms and cybersecurity services.

Resecurity

Resecurity

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

Lastline

Lastline

Lastline is the leader in advanced malware protection.

TNO Cyber Security Lab

TNO Cyber Security Lab

TNO Cyber Security Lab is a dedicated facility for innovative and experimental research with the goal of a safe and resilient cyberspace.

ThaiCERT

ThaiCERT

ThaiCERT is the national Computer Security Incident Response Team (CSIRT) for Thailand.

Information Security Research Group - University of South Wales

Information Security Research Group - University of South Wales

The Information Security Research Group has an international reputation in the areas of network security, computer forensics and threat analysis.

Detectify

Detectify

Detectify is a web security service that simulates automated hacker attacks on your website, detecting critical security issues before real hackers do.

Telia Cygate

Telia Cygate

Cygate are specialists in information security, data networks, and data centre and cloud technologies.

TechVets

TechVets

TechVets is a non-for-profit helping UK veterans and service leavers retrain into Cyber Security and Technology jobs.

Silensec

Silensec

Silensec is a management consulting, technology services and training company specialized in information security.

Samoby

Samoby

Samoby provide a subscription solution for Mobile Threat Protection and usage control on Android and iOS devices.

SQN Banking Systems

SQN Banking Systems

SQN Banking Systems fraud detection software products are a critical step towards overcoming the growing problem of fraud across the various payment channels.

Veriff

Veriff

Veriff provides highly-automated identity-verification services that prevent fraud like nothing else on the market.

Jisc

Jisc

Jisc is a membership organisation working in partnership with the UK’s research and education communities to develop the digital technologies they need to teach, discover and thrive.

Celcom

Celcom

Celcom is the oldest mobile telecommunications provider in Malaysia, providing solutions and services to consumers and businesses.

Otava

Otava

Otava is a global leader of secure, compliant hybrid cloud and IT solutions for service providers, channel partners and enterprise clients.

Redapt

Redapt

Redapt is an end-to-end technology solutions provider that brings clarity to a dynamic technical environment.

CyPro

CyPro

CyPro is a cyber security expert firm that specialises in providing cyber security services tailored for high-growth companies at every stage of their journey.