Religious Organizations Among Targets for Chinese Cyber Threats

Malicious cyber activity enabled by the Integrity Technology Group (Integrity Tech)—a China-based company with ties to the Chinese government—is globally targeting religious, law enforcement, and education organizations, as well as entities in the fields of government services and facilities, critical manufacturing, healthcare and public health, and information technology US critical infrastructure sectors, according to a joint advisory by the Cybersecurity and Infrastructure Security Agency (CISA), FBI, National Security Agency (NSA), and international partners.

[ Read the SemperVerus article, Mitigating Attacks on Houses of Worship Security Guide ]

These Integrity Tech-enabled threat actors employ a sophisticated combination of large-scale botnets, virtual private network (VPN) infrastructure, living off the land techniques (a cyberattack technique where hackers use native, legitimate tools already present on a victim’s system to carry out malicious activities), and repositories of computer network exploitation tools to infiltrate networks and exfiltrate sensitive data.

[ Read the SemperVerus article, DHS Outlines Steps Houses of Worship Can Take To Protect Themselves ]

Their tactics, techniques, and procedures are consistent with cyber activity known publicly as Flax Typhoon, Ethereal Panda, and Red Juliett—among other names—and include exploiting vulnerabilities through automated scanning tools, cross-site scripting (XSS) attacks, and password spraying.

[ Read the SemperVerus article, Emergency Preparedness Resource Links ]

This advisory shares detection and mitigation guidance to help network defenders across public and private sector organizations reduce the risk of compromise and provides a full list of successfully exploited Common Vulnerabilities and Exposures.

[ Read the SemperVerus article, Church Security: Detect Threats With the “Power of Hello” ]

Key Actions to Protect Your Organization:
    •  Disable unused services and ports, such as automatic configuration, remote access, or file sharing protocols.
    •  Sanitize user input in web applications to prevent possible XSS payload injection.
    •  Implement identity, credential, and access management (ICAM) policies, and require multifactor authentication for services (to the extent possible).

[ Read the SemperVerus article, Counterterrorism Guide: Situational Awareness to Hinder An Attack ]

Read the full advisory here.

[ Bookmark the SemperVerus CHURCH SECURITY INTELLIGENCE CLIPBOARD ]

Invite SemperVerus^® to present its 5 life-changing success-generating components—prepare, aware, be, know, do—to your organization to inspire and motivate your members.

Join the SemperVerus Brotherhood™!