Ep. 86 - Flax Typhoon Ran on 1,300 Scripts and a 12-Year-Old Bug Nobody Patched

Ten government agencies across seven countries put their names on one advisory. AA26-281A profiles Integrity Technology Group — a China-based, for-profit contractor that builds, sells and hosts the tooling behind large-scale intrusions, and whose domains the FBI seized on October 8. Tova Dvorin and Adrian Culley break down MicroScan’s 1,300 pentest scripts, the eBurst spray that tries ten interfaces into one Microsoft 365 mailbox, SoftEther VPN hiding behind trusted Windows process names, and a 12-year-old Bash CVE still exploited in the wild.

More on AA26-281A: https://www.safebreach.com/blog/integrity-technology-group-cisa-aa26-281a-safebreach-coverage/

00:00 What is Integrity Tech, and why does the Flax Typhoon advisory matter?

03:27 How do these Chinese State Actors find their targets?

04:17 Does MicroScan use 1,300 scripts to scan the internet at scale?

05:01 Which eight CVEs were exploited, and why is a 12-year-old Bash bug still working?
The eight exploited CVEs affect GNU Bash (CVE-2014-6278), ProFTPD (CVE-2015-3306), ISC BIND (CVE-2015-5477), Apache Struts (CVE-2016-3081), Pulse Connect Secure (CVE-2019-11510), GitLab (CVE-2021-22205), ONLYOFFICE (CVE-2021-3199) and Strapi (CVE-2023-22894), and the 2014 Bash bug, a Shellshock variant, still works because many legacy internet-facing systems were never patched or replaced.

06:45 How did hands-on exploitation and cross-site scripting fit into the campaign?

08:31 How do eBurst attacks target Microsoft email accounts?

09:38 How did attackers use SoftEther VPN to hide their access?

11:10 How did attackers steal email, run DCSync, and get into Microsoft 365?

14:31 What should defenders monitor, test, and validate?

#cybersecurity #infosec #CISO #FlaxTyphoon #IntegrityTech #Microsoft365 #CTEM #SafeBreach