Chinese snoops exploit F5, ConnectWise bugs to sell access

Chinese spies exploited a couple of critical-severity bugs in F5 and ConnectWise equipment earlier this year to sell access to compromised US defense organizations, UK government agencies, and hundreds of other entities, according to Mandiant. The Google-owned threat hunters said they assess, "with moderate confidence," that a crew they track as UNC5174 was behind the exploitation of CVE-2023-46747, a 9.8-out-of-10-CVSS-rated remote code execution bug in the F5 BIG-IP Traffic Management User Interface, and CVE-2024-1709, a path traversal flaw in ConnectWise ScreenConnect that scored a perfect 10 out of 10 CVSS severity rating. UNC5174 uses the online persona Uteus, and has bragged about its links to China's Ministry of State Security (MSS) – boasts that may well be true. The gang focuses on gaining initial access into victim organizations and then reselling access to valuable targets. During the course of its investigation into the F5 and ConnectWise exploits, Mandiant found UNC5174 could indeed be working as a contractor for MSS as an initial access broker. "The actor claimed MSS affiliation in dark web forums, claiming tacit backing of an unspecified MSS-related APT actor," Mandiant's Michael Raggi, Adam Aprahamian, Dan Kelly, Mathew Potaczek, Marcin Siedlarz, and Austin Larsen wrote in a Thursday threat-intel report. "Additionally, the impacted organizations targeted by UNC5174, including US defense and UK government entities, were targeted concurrently by distinct known M...