Airline industry affected by supply-chain attack allegedly done by Chinese espionage group APT-41

Threat Advisories

Airline industry affected by supply-chain attack allegedly done by Chinese espionage group APT-41

THREAT LEVEL: Red.

For a detailed advisory, download the pdf file here.

A supply chain attack was carried out on the airline industry, which started with SITA being compromised, allegedly done by Chinese espionage group APT-41. SITA is responsible for providing  software solutions to 90% of airlines in the world. The attack was carried forward by deploying Cobalt Strike beacons in the infrastructure of airlines using the SITA data processing server and BadPotato malware is used for privilege escalation. The attackers later used hash dump and mimikatz to exfiltrate NTLM hashes and plain-text passwords.

The Techniques used by APT41 include:

  • T1195 – Supply Chain Compromise
  • T1059 – Command and Scripting Interpreter
  • T1569.002 – Service Execution
  • T1543.003 – Windows Service
  • T1134 – Access Token Manipulation
  • T1055 – Process Injection
  • T1070 – Indicator Removal on Host
  • T1550 – Use Alternate Authentication Material
  • T1021 – Remote Services
  • T1003 – OS Credential Dumping
  • T1046 – Network Service Scanning
  • T1005 – Data from Local System
  • T1071.004 – DNS
  • T1029 – Scheduled Transfer
  • T1550.002 – Pass the Hash
  • T1021.002 – SMB/Windows Admin Shares
  • T1070.004 – File Deletion
  • T1055.012 – Process Hollowing

Threat Actor

Indicators of Compromise

References

https://blog.group-ib.com/colunmtk_apt41

https://www.cnbctv18.com/aviation/china-backed-apt41-behind-sita-and-air-india-cyber-attacks-9634641.html

https://threatpost.com/supply-chain-attack-airlines-state-actor/166842/