Cybersecurity agencies and law enforcement in the United States and Japan have issued a warning about the Chinese hacking group known as ‘BlackTech.’ This group is targeting network devices, specifically Cisco routers, to implant customized backdoors for unauthorized access to corporate networks. This alert involves multiple organizations, including the FBI, NSA, CISA, Japan’s NISC, and the NPA, emphasizing the gravity of this state-sponsored cyber espionage operation.
Technical Overview of BlackTech’s Operations
BlackTech, also known as Palmerworm, Circuit Panda, and Radio Panda, is a state-sponsored APT group active since at least 2010. They have been conducting cyber espionage against targets in Japan, Taiwan, Hong Kong, and other regions, spanning various sectors. Their sophisticated tactics include using continuously updated custom malware to implant backdoors in network devices, which are used for initiating breaches, maintaining access, and data exfiltration.
Modus Operandi of BlackTech
This group exploits stolen administrative credentials to compromise various router brands and models. They establish persistence, move laterally across networks, and modify firmware to conceal their activities. Their tactics include enabling SSH backdoors and patching memory in Cisco devices to bypass signature validation functions, loading modified firmware with pre-installed backdoors.
Impact on Cisco Routers
BlackTech manipulates Embedded Event Manager (EEM) policies in Cisco routers, removing strings from legitimate commands to hinder forensic analysis. While Cisco has clarified that there’s no evidence of BlackTech exploiting vulnerabilities in their products or using stolen certificates for malware, the group’s method of downgrading firmware to bypass security measures primarily affects older Cisco products.
Recommendations for Mitigation
- Implement Transport Output Control: Use the “transport output none” command to block external connections and reduce unauthorized access risks.
- Monitor Traffic: Vigilantly monitor inbound and outbound traffic for unauthorized access attempts and use VLANs to segregate administrative systems.
- IP Address Whitelisting: Restrict network administrator access to specific IP addresses and monitor login attempts for enhanced control.
- Adopt Secure Boot Devices: Transition to devices with advanced secure boot capabilities and update outdated equipment.
- Change Passwords and Keys Immediately: In case of a suspected breach, promptly change all associated passwords and encryption keys.
- Analyze Logs Regularly: Monitor logs for anomalies such as unexpected reboots or configuration changes.
- Implement Network Device Integrity Methodology: Employ NDI Methodology to detect unauthorized alterations.
- Verify Firmware and Boot Records: Regularly compare boot records and firmware versions to trusted versions to identify potential compromises.
Conclusion
The exploitation of network devices by the BlackTech hacking group is a stark reminder of the ongoing cybersecurity threats posed by state-sponsored actors. Their advanced tactics in compromising router firmware and evading detection require organizations to adopt a comprehensive and proactive approach to cybersecurity. This includes vigilant monitoring, regular updates, and robust security practices to defend against such sophisticated threats.