APT40 exploits internet-facing infrastructure across Australian networks

Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.

PRC state-sponsored APT40 rapidly exploits public vulnerabilities in web applications and remote access systems to establish persistence and exfiltrate credentials.

CISA, NSA, ACSC, and allied agencies published detailed case studies of APT40 tradecraft targeting Australian organizations. The group, assessed to work for China's Ministry of State Security, specializes in rapid exploitation of internet-exposed infrastructure—particularly custom web applications and remote access portals—over phishing or other user-interaction techniques. APT40 conducts extensive reconnaissance, deploys web shells for persistence, and prioritizes credential theft to enable lateral movement and data exfiltration.

Two anonymized case studies document intrusions from mid-2022. Case Study 1 describes a July–September 2022 breach where APT40 exploited a custom web application running in the victim's DMZ, deployed web shells, and used compromised credentials and Kerberoasting to access internal systems and steal Active Directory data. The group used Secure Socket Funnelling (SSF) to tunnel outbound traffic. Case Study 2 details an April 2022 compromise of a remote access appliance via likely RCE vulnerabilities, where actors collected hundreds of valid username–password pairs, MFA codes, and JWTs to hijack legitimate VDI sessions and pivot internally.

APT40 exhibits notable operational adaptation: the group has evolved from using compromised Australian websites as C2 to leveraging compromised SOHO devices as last-hop redirectors to obscure infrastructure and evade tracking. The advisory emphasizes that APT40 exploits vulnerabilities weeks or years old (CVE-2021-44228, CVE-2021-31207, CVE-2021-26084, CVE-2021-34523, CVE-2021-34473) when systems remain unpatched, and prioritizes rapid patching of internet-facing infrastructure within 48 hours, comprehensive logging, network segmentation, and credential monitoring.

title: Web Server Process Spawning Command Shell
id: bf6e6566-3b3a-51f6-a240-28b72332d161
status: experimental
description: Detects web server processes (IIS w3wp, Apache httpd, Nginx, Tomcat)
  spawning a command interpreter. This is typical of web shell activity after exploitation
  of an internet-facing application, as in the APT40 intrusions. Matches the parent/child
  relation, not any specific shell file name.
tags:
- attack.persistence
- attack.t1505.003
- attack.initial-access
- attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
    - \w3wp.exe
    - \httpd.exe
    - \nginx.exe
    - \tomcat7.exe
    - \tomcat8.exe
    - \tomcat9.exe
    - \php-cgi.exe
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
  filter_iis_appcmd:
    CommandLine|contains: appcmd.exe
  condition: selection_parent and selection_child and not filter_iis_appcmd
falsepositives:
- Web applications that legitimately shell out to cmd.exe for report generation or
  file conversion
- Administrative web consoles running maintenance scripts through the web server account
level: high
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-190a

title: Possible Kerberoasting - RC4 Service Ticket Requests for User Service Accounts
id: c716f920-7cae-5779-82e1-cb3847b0f0a6
status: experimental
description: Detects Kerberos service ticket requests (Event 4769) that use RC4 (0x17)
  encryption for service accounts that are not computer accounts or krbtgt. Kerberoasting
  shows up as many such events from one requesting account in a short period, so alert
  on a count threshold per TargetUserName/IpAddress in the SIEM, as the condition
  here cannot express it.
tags:
- attack.credential-access
- attack.t1558.003
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4769
    TicketEncryptionType: '0x17'
    Status: '0x0'
  filter_machine_and_krbtgt:
  - ServiceName|endswith: $
  - ServiceName: krbtgt
  filter_machine_requester:
    TargetUserName|startswith: $
  condition: selection and not filter_machine_and_krbtgt and not filter_machine_requester
falsepositives:
- Legacy applications or services that only support RC4 Kerberos encryption
- Vulnerability scanners or AD audit tools that enumerate SPNs
level: medium
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-190a

title: Secure Socket Funnelling Tunnel Tool Execution
id: 8d4961f2-589d-5973-bfc8-6595c6f931bb
status: experimental
description: Detects execution of Secure Socket Funnelling (SSF) client or daemon
  binaries with port-forward, reverse-forward or SOCKS proxy options. APT40 used SSF
  to tunnel traffic out of victim networks. Matches the tool image names combined
  with its tunnelling flags.
tags:
- attack.command-and-control
- attack.t1572
logsource:
  category: process_creation
  product: windows
detection:
  selection_image:
    Image|endswith:
    - \ssf.exe
    - \ssfd.exe
  selection_flags:
    CommandLine|contains:
    - ' -D '
    - ' -L '
    - ' -R '
    - ' -X '
    - ' -p '
  condition: selection_image and selection_flags
falsepositives:
- Administrators legitimately using SSF for authorised port forwarding
- Unrelated software that ships a binary named ssf.exe
level: medium
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-190a

Source reporting: https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-190a