The Canadian Centre for Cyber Security (Cyber Centre) has joined the United States’ Federal Bureau of Investigation (FBI) and the following international partners in releasing cyber security guidance on the Peoples Republic of China (PRC) government-linked threat actors combining automated and hands-on hacking tools to steal sensitive information:
- Cybersecurity and Infrastructure Security Agency (CISA)
- National Security Agency (NSA)
- United Kingdom’s National Cyber Security Centre (NCSC-UK)
- New Zealand’s National Cyber Security Centre (NCSC-NZ)
- Australian Signals Directorate (ASD)
- Japan’s National Police Agency (NPA)
- Japan’s National Cybersecurity Office (NCO)
- Spain’s Centro Nacional de Inteligencia (CNI)
This joint guidance details how PRC-linked threat actors exploit networks across multiple sectors. It provides organizations an analysis of tactics, techniques and procedures (TTPs) and indicators of compromise (IOCs) from the threats posed by these actors.
Network defenders can apply detection and mitigation strategies that reduce the risks of threat actors compromising critical data. Organizations can take the following immediate actions to protect against PRC-linked cyber threat activity:
- Disable unused services and ports, such as automatic configuration, remote access or file sharing protocols
- Sanitize user input in web applications to prevent possible cross-site scripting (XSS) payload injection
- Implement identity, credential and access management (ICAM) policies and require multi-factor authentication (MFA) for services, where possible
Consult the full joint guidance: Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data (PDF)