Airline industry affected by supply-chain attack allegedly done by Chinese espionage group APT-41

For a detailed advisory, download the pdf file here.

A supply chain attack was carried out on the airline industry, which started with SITA being compromised, allegedly done by Chinese espionage group APT-41. SITA is responsible for providing  software solutions to 90% of airlines in the world. The attack was carried forward by deploying Cobalt Strike beacons in the infrastructure of airlines using the SITA data processing server and BadPotato malware is used for privilege escalation. The attackers later used hash dump and mimikatz to exfiltrate NTLM hashes and plain-text passwords.

The Techniques used by APT41 include:

T1195 – Supply Chain CompromiseT1059 – Command and Scripting InterpreterT1569.002 – Service ExecutionT1543.003 – Windows ServiceT1134 – Access Token ManipulationT1055 – Process InjectionT1070 – Indicator Removal on HostT1550 – Use Alternate Authentication MaterialT1021 – Remote ServicesT1003 – OS Credential DumpingT1046 – Network Service ScanningT1005 – Data from Local SystemT1071.004 – DNST1029 – Scheduled TransferT1550.002 – Pass the HashT1021.002 – SMB/Windows Admin SharesT1070.004 – File DeletionT1055.012 – Process Hollowing

Threat Actor

Indicators of Compromise

References