Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
High
Nation-State actors from China are attacking financial institutions in Taiwan. The attackers used stealthy techniques to evade detection in a campaign that lasted 18 months. The attackers leveraged EternalBlue exploits and also deployed a backdoor called xPack that allowed them to run WMI commands on the affected systems remotely.
Like most APTs, the campaign was used to exfiltrate data and cyber espionage. At least three organizations were targeted by this attacker in Taiwan. Which includes two financial organizations and a manufacturing company. Interestingly, the threat actors were able to infiltrate the financial and manufacturing organization for 250 and 175 days respectively.
Symantec, a division of Broadcom, cannot state with certainty what the initial infection vector used by the attackers in this campaign was, though in one instance they were seen utilizing the MSSQL service to execute system commands, which indicates that the most likely infection vector was exploitation of a web application or service.
Antlion APT is also known to use malicious emails and phishing techniques to gain initial access to the victim’s networks. The xPack backdoor is a custom .NET loader that decrypts, loads, and executes .bin files. The attackers also used a variety of LoL (living-off-the-land) tools such as WMIC, PowerShell, LSASS, ProcDump, and PsExec.