IOC Extinction? China-Nexus Cyber Espionage Actors Use ORB Networks to Raise Cost on Defenders
cloud.google.com · Undated · Licence: not cleared; local research copy only
CVEs this report names
1 CVE- CVE-2022-27518Citrix Application Delivery Controller (ADC) and Gateway Authentication Bypass VulnerabilityCitrix · Application Delivery Controller (ADC) and GatewayKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter1 report6.9%Top 6%72.5priority
Where it names them
CVE-2022-27518 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
Active since at least 2019, UNC2630 (with suspected links to APT5), used a known SPACEHOP node to exploit CVE-2022-27518 in late December 2022.
The National Security Agency (NSA) linked exploitation of CVE-2022-27518 within the same time frame to APT5.
Techniques drawn from this report
NoneNo passage in this report has been tied to an ATT&CK technique.