{"id":46080,"date":"2022-04-07T09:45:07","date_gmt":"2022-04-07T09:45:07","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/how-do-chinas-cyber-spies-snoop-on-governments-ngos-probably-like-this\/"},"modified":"2022-04-07T09:45:07","modified_gmt":"2022-04-07T09:45:07","slug":"how-do-chinas-cyber-spies-snoop-on-governments-ngos-probably-like-this","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/how-do-chinas-cyber-spies-snoop-on-governments-ngos-probably-like-this\/","title":{"rendered":"How do China’s cyber-spies snoop on governments, NGOs? Probably like this"},"content":{"rendered":"

A China-backed crew is said to be running a global espionage campaign against governments, religious groups, and non-governmental organizations (NGOs) by, in some cases, possibly exploiting a vulnerability in Microsoft Exchange servers.<\/p>\n

+Symantec’s Threat Hunter Team said the campaign, which aims to spy on targeted victims and steal information, likely started in mid-2021, with the most recent activity detected in February. It may still be going on, the researchers observed in a report<\/a> this week.<\/p>\n

The Threat Hunter Team team is attributing the attacks to Cicada, also known as APT10 \u2013 a group that has been operating for more than a decade and that intelligence agencies in the US have linked<\/a> to China’s Ministry of State Security. The researchers are pointing at Cicada because a custom loader and custom malware that have been used exclusively by the group were found in victims’ networks.<\/p>\n