Chinese hackers bypass 2FA

A Chinese hacking group has been able to successfully target Western government entities by bypassing Two-Factor Authentication protections.

According to Dutch cybersecurity company, Fox-IT, the hackers were able to remain undetected in compromised systems precisely because they were able to exploit existing security tools already present.

Abundance of cybersecurity tools puts enterprises at risk
Stay safe and anonymous online with the best VPN
The need for open source audits in cybersecurity M&As

Exploited software

The claims were made by Fox-IT after two years of investigations into compromised systems, which they released in a whitepaper in which they identified the hackers’ activities and methods.

The key actor was identified as the APT20 hacking group, which is claimed to have worked under the authority of the Chinese government for nearly ten years. The group targets government agencies and Managed Service Providers (MSPs) by exploiting vulnerabilities in web servers to access networks.

From there, they can install web shells to facilitate moving through the IT networks, focusing on enterprise application platforms. The hackers also targeted user workstations with administrator privileges, as well as password vaults.

The most surprising finding was that Two-Factor Authentication (2FA) protocols could be bypassed in vulnerable systems, with the hackers able to generate their own software tokens for access within exploited software.

Fox-IT reports that the easiest way to defend against such attacks is by robust use of segmentation, as well as leveraging Microsoft’s Enhanced Security Administrative Environment (ESAE) for greater security.

Via ZDnet