Filipinos Under Fire From ‘Mustang Panda’

Every week, Information Security Media Group rounds up cybersecurity incidents and breaches around the world. This week: the advanced persistent threat group codenamed “Mustang Panda” targets the Philippine government; Kansas Courts warn of data theft; U.S. cybersecurity adds flaws in Sophos, Oracle and Microsoft products to its list of exploited vulnerabilities; AutoZone details data lost to Clop; and Optus’ CEO resigns over a serious network outage.

See Also: Live Webinar | Generative AI: Myths, Realities and Practical Use Cases

Security researchers have tied to a China-aligned hacking group codenamed Mustang Panda – aka Stately Taurus – to a series of phishing attacks, including against the government of the Philippines, which is escalating already existing tensions in the disputed South China Sea. The news follows Palo Alto Networks Unit 42 tracking the same group running three separate August campaigns targeting organizations in the South Pacific. Attackers targeted legitimate software, such as Solid PDF Creator and SmadavProtect, via DLL side-loading tactics, and mimicked Microsoft traffic to disguise their command-and-control connections. Experts said the group’s targets regularly align with Beijing’s geopolitical interests.

The Kansas state court system warned that the “security incident” it suffered last month led to hackers stealing sensitive files containing confidential information. The incident resulted in numerous systems going offline, an electronic filing system used by attorneys, as well as electronic payment systems, and case management systems for district and appellate courts. More than five weeks post-attack, these services remain offline.

Kansas state’s court system said attackers have threatened to leak stolen data if their ransom demands – the state did not specify what those are – don’t get met. The state said stolen information appears to include Office of Judicial Administration files and district court case records on appeal, including sensitive and confidential data.

The U.S. Cybersecurity and Infrastructure Security Agency on Tuesday added product flaws from Sophos, Oracle and Microsoft to its list of known exploited vulnerabilities. One exploited flaw is in Sophos Web Appliance and allows unauthenticated attackers to execute arbitrary code. Sophos patched the flaw in April, and the affected appliance was official “end of life” in July. CISA’s known exploited vulnerabilities list also includes four other Sophos product vulnerabilities.

Other recent additions to the list include a vulnerability in Oracle WebLogic Server, which experts warn a China-affiliated threat actor has been exploiting to target government and critical infrastructure in Taiwan. Another listing details a vulnerability designated CVE-2023-36584, which attackers can use to bypass Windows’ Mark of the Web security feature.

Auto parts retailer AutoZone reported that it suffered a ransomware attack at the hands of the Clop group, leading to the exposure of information tied to 185,000 individuals. The data theft dates from May, when the retailer was one of over 2,600 organizations hit when the Clop – aka Cl0p – group launched its mass exploitation of a vulnerability in MOVEit secure file-transfer software, allowing it to steal data being stored (see: Known MOVEit Attack Victim Count Reaches 2,618 Organizations).

AutoZone confirmed the attack in August, and its ongoing investigation identified the full extent of the data breach only this month. Clop already listed the retailer as a victim on its data-leak site in July, claiming it stole 1.1 gigabytes of internal and employee data. AutoZone said exposed information included full names and Social Security numbers.

Kelly Bayer Rosmarin, CEO of Australia’s second largest telecommunications carrier, Optus, resigned following a 12-hour network-wide outage affecting nearly half of Australia’s population. The outage occurred just days after a parliamentary hearing in which Optus executives admitted having no contingency plan for a disruption of such scale. Chief Financial Officer Michael Venter will step in as interim CEO.

Rosmarin, who took the helm in April 2020, faced numerous challenges during her tenure, including a massive data breach exposing 10 million Australians’ personal data, leading to lawsuits and regulatory investigations. The recent network blackout further strained Optus’ reputation and highlighted telecommunications infrastructure concerns. Singtel, Optus’ parent company, promised to work to regain customer trust and confidence, citing ongoing efforts to mitigate the outage’s impact.

More Breach Stories From the Past Week