China’s Salt Typhoon hackers target telecom firms in Southeast Asia with new malware

Category	Details
Threat Actors	Salt Typhoon (also referred to as Earth Estrie by Trend Micro).
Campaign Overview	Targeting Southeast Asian telecom firms with the GhostSpider backdoor and conducting long-term espionage campaigns.
Target Regions	Southeast Asia (telecom industry), with prior campaigns targeting the U.S., Asia-Pacific, Middle East, and South Africa.
Methodology	Exploiting flaws in public-facing servers, using legitimate tools for lateral movement, and deploying modular malware for persistence and espionage.
Product Targeted	Telecommunications infrastructure, Linux devices (via Masol RAT), and public-facing servers.
Malware Reference	GhostSpider (multi-modular backdoor), Masol RAT (targeting Linux).
Tools Used	Modular malware, web vulnerabilities, and legitimate tools for lateral movement.
Vulnerabilities Exploited	Flaws in public-facing servers and web vulnerabilities.
TTPs	- Deploying modular malware (GhostSpider). - Exploiting server flaws for initial access. - Leveraging legitimate tools for lateral movement.
Attribution	Attributed to Salt Typhoon (Chinese state-sponsored group) with potential overlap in tools and techniques with other Chinese hacker groups like Volt Typhoon.
Recommendations	- Patch public-facing servers regularly. - Monitor for lateral movement using legitimate tools. - Deploy threat intelligence to detect GhostSpider and Masol RAT.
Source	The Record

Read full article: https://therecord.media/china-salt-typhoon-targets-southeast-asia-telecom

Disclaimer: The above summary has been generated by an AI language model