CISA Alerts: July 8, 2024 – CISA & ASD’s ACSC Release Joint Advisory on PRC APT40 Tradecraft in Action

The Cybersecurity and Infrastructure Security Agency (CISA) has partnered with the Australian Signals Directorate's Australian Cyber Security Centre (ASD's ACSC) to issue an advisory: People’s Republic of China (PRC) Ministry of State Security APT40 Tradecraft in Action.

These organizations also collaborated with ASD's ACSC:

• The National Security Agency (NSA)
• The Federal Bureau of Investigation (FBI)
• The United Kingdom’s National Cyber Security Centre (NCSC-UK)
• The Canadian Centre for Cyber Security (CCCS)
• The New Zealand National Cyber Security Centre (NCSC-NZ)
• The German Federal Intelligence Service (BND) and Federal Office for the Protection of the Constitution (BfV)
• The Republic of Korea’s National Intelligence Service (NIS) and NIS’ National Cyber Security Center (NCSC)
• Japan’s National Center of Incident Readiness and Strategy for Cybersecurity (NISC) and National Policy Agency (NPA)

The advisory is based on current ACSC-led incident response investigations and shared understanding of a PRC state-sponsored cyber group, APT40—also known as Kryptonite Panda, GINGHAM TYPHOON, Leviathan and Bronze Mohawk. APT 40 has previously targeted organizations in various countries, including Australia and the United States.

APT40 is known for its ability to quickly adapt and transform exploit proofs-of-concept (POCs) for new vulnerabilities, deploying them immediately against targeted networks with the relevant infrastructure. The group consistently performs reconnaissance on networks of interest, including those within the countries of the authoring agencies, seeking opportunities for compromise. This ongoing reconnaissance enables APT40 to detect vulnerable, end-of-life, or unmaintained devices on these networks and swiftly execute exploits. The group has successfully exploited vulnerabilities dating back to 2017.

In a published case study, ASD’s ACSC investigators stated:

“In mid-August 2022, the ASD’s ACSC notified the organization that a confirmed malicious IP believed to be affiliated with a state-sponsored cyber group had interacted with the organization’s computer networks between at least July and August. The compromised device probably belonged to a small business or home user.”

APT 40 identifies new exploits within widely used public software to target the infrastructure of the associated vulnerability including the following: