APT40

APT40 is a China-attributed cyber espionage group known for targeting countries strategically significant to the Belt and Road Initiative. The group has been linked to at least 51 different code families, exhibiting a broad range of capabilities. APT40 typically employs spear-phishing emails, often impersonating prominent individuals likely to be of interest to their targets. In addition to these techniques, APT40 has also utilized compromised devices, including small-office/home-office (SOHO) devices, as operational infrastructure and last-hop redirectors for its operations in Australia. The group prefers exploiting vulnerable public-facing infrastructure over other hacking techniques like phishing. The group has shown a remarkable capacity to rapidly exploit newly discovered software vulnerabilities. This was evidenced when APT40 was found exploiting such vulnerabilities within hours of their discovery, launching attacks on organizations worldwide, including repeated assaults on Australian networks. The group has successfully exploited vulnerabilities dating back to 2017, and they have recently targeted widely used software such as Log4J, Atlassian Confluence, and Microsoft Exchange. Over the years, APT40 has conducted cyberespionage campaigns against government and private organizations in multiple countries, as highlighted in a joint advisory from various international agencies. These include the Australian Cyber Security Center, the cybersecurity arm of Australia's federal intelligence agency, the Australian Signals Directorate, and counterparts in New Zealand, Japan, South Korea, the United States, the United Kingdom, Canada, and Germany. To mitigate the risk posed by APT40, the ASD’s ACSC strongly recommends implementing the ASD Essential Eight Controls and associated Strategies to Mitigate Cyber Security Incidents.