APT40

APT40, a threat actor attributed to China, is a cyber espionage group that primarily targets countries of strategic importance to the Belt and Road Initiative. The group is known for its use of a variety of attack vectors, notably spear-phishing emails posing as individuals likely to be of interest to the target. APT40 has been observed using at least 51 different code families in their operations, demonstrating a high level of technical sophistication. Notably, the Salt Typhoon hacking campaign, affiliated with APT40, focuses on intelligence gathering rather than infrastructure disruption, distinguishing it from other Chinese-linked Advanced Persistent Threat (APT) groups such as Volt Typhoon. Over the years, APT40 has conducted numerous cyberespionage campaigns against government and private organizations across multiple countries, including Australia, New Zealand, Japan, South Korea, the United States, the United Kingdom, Canada, and Germany. This information was revealed in a joint advisory from the Australian Cyber Security Center and international agencies. The group has been identified exploiting newly discovered software vulnerabilities within hours of their public disclosure, targeting organizations globally and repeatedly attacking Australian networks. APT40's operational strategy includes the use of compromised devices, including small-office/home-office (SOHO) devices, as infrastructure and last-hop redirectors for its operations in Australia. In response to these threats, the Australian Signals Directorate’s Australian Cyber Security Centre strongly recommends implementing the ASD Essential Eight Controls and associated Strategies to Mitigate Cyber Security Incidents. These measures can help detect and prevent intrusions by APT40 and other similar threat actors.