The Canadian Centre for Cyber Security (Cyber Centre) has joined the Australian Signals Directorate’s Australian Cyber Security Centre and the following international partners in releasing joint guidance to highlight and safeguard against an ongoing network intrusion threat from a cyber group associated with the People’s Republic of China (PRC) Ministry of State Security (MSS):
- the United States Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA), and Federal Bureau of Investigation (FBI)
- the United Kingdom National Cyber Security Centre (NCSC-UK)
- the New Zealand National Cyber Security Centre (NCSC-NZ)
- the German Federal Intelligence Service (BND) and Federal Office for the Protection of the Constitution (BfV)
- the Republic of Korea’s National Intelligence Service (NIS) and the NIS’s National Cyber Security Center
- Japan’s National Center of Incident Readiness and Strategy for Cybersecurity (NISC) and National Policy Agency (NPA)
The state-sponsored cyber group seeks to target government and private sector networks by:
- exploiting vulnerable devices that are at the end of their life cycle, unpatched or no longer maintained
- exploiting new public vulnerabilities in widely used software
- using compromised devices as launching points to conduct attacks designed to blend in with legitimate network traffic
The joint guidance shares information and mitigation measures, as well as case studies that demonstrate the cyber group’s tools and tradecraft.
Organizations should safeguard against network intrusion threats by:
- maintaining comprehensive and historical logging information
- issuing prompt patches for all Internet-connected devices and services
- segmenting networks and enforcing strict access control measures, particularly for Active Directory and authentication servers
Additional mitigation measures to prevent against this and similar network intrusion threats include:
- disabling unused or unnecessary network services, ports and protocols
- using firewalls to protect web servers and applications
- implementing multi-factor authentication
- replacing end-of-life equipment
Read the joint guidance PRC MSS tradecraft in action.