Top 25 Vulnerabilities Exploited by Chinese Sponsored Hackers

On June 8, 2022, the CISA, the FBI, and the NSA have issued a joint advisory to warn organizations about Chinese cyber-espionage attacks.  The advisory reveals a list of 16 CVEs exploited by Chinese threat actors. It also stated that the attacks are primarily aimed at telecommunications companies and are conducted by exploiting vulnerabilities. It has also suggested that organizations should take additional mitigation steps to remove such attacks in the initial stage.

The National Security Agency listed 25 vulnerabilities that are being targeted by Chinese state sponsored cyber attackers popularly known as APT41. Know more about these vulnerabilities and patch them before you fall prey to a breach.

We examined 25 vulnerabilities listed in the security advisory and analyzed them for interesting correlations.

Here are our findings –

• 12 CVEs with RCE capabilities
• 3 CVEs with Privilege Execution
• 6 CVEs are associated with APT Groups
• 1 CVE is associated with Lazarus Malware
• 4 CVEs are associated with Ransomware
• 2 CVE’s were called out in our Cyber Risk Series

Among these 25 weaponized, 21 CVEs rank under Top 25 Common Weakness Enumeration (CWE) making them easy to exploit and the rest four CVEs are ranking under Top 30.

Out of 25 vulnerabilities, 18 CVEs have known exploits. Given below are the details.

Table 1: Known Exploits

Our threat researchers analyzed the constant cybercriminal activity related to exploit kits and found two CVEs CVE-2019-19781 and CVE-2019-11510 associated with four exploit kits. We also noticed that older exploit kits such as the RIG exploit kit, Fallout exploits kit are getting upgraded with the newer elements and capabilities.

CVE’s Associated with Ransomware

We also found that four CVEs out of 25 are associated with 21 Ransomware families. Interestingly, these old vulnerabilities range from the year 2019.

Table 2: Associated Ransomware

We called out vulnerabilities CVE-2019-19781 and CVE-2019-11510 associated with REvil and Sodinokibi Ransomware in Cyber Risk in Remote Desktop and Cyber Risk in VPN. We red flagged these vulnerabilities as potential gateways for ransomware attacks and we have been proved right.

CWE Analysis of 25 Vulnerabilities

We also analyzed CWE ids and found that CWE-502 was highly targeted by the threat actors followed by CWE-22. CWE-502 categorizes vulnerabilities where the application deserializes untrusted data without verifying the resulting data as valid.

CWE-22 categorizes weaknesses that result in improper limitation of a pathname resulting in a location outside the restricted directory. Both these CWEs find a place in the Top 25 dangerous programming errors.

Table 3: CWE Ranking

Vendors Analysis

Notably, Microsoft tops the most affected vendor list exploited by the Chinese hackers. It is followed by Citrix in the second place.

Table 4: Affected Vendors

Most targeted Vulnerability by Threat Actors

Over half of the vulnerabilities are  RCE – the most targeted bug. The attacker executes the code remotely by running malware and gains full access to data, and also carries out a full distributed denial of service.

These products need to be prioritized for immediate patching.  The following CVEs have low severity rating CVE-2020-8193, CVE-2020-8195, CVE-2020-8196, and CVE-2019-1040 with a CVSS Score of below 5.0. Their severity scores make them low priority for security teams which is why these vulnerabilities are routinely weaponized and targeted by malicious groups.

Patches are available for all 25 vulnerabilities. We urge you to patch these immediately and secure your environment.

25 Vulnerabilities & Patches

Table 5: Patches for Exploited Vulnerabilities