{"id":7524,"date":"2021-07-08T20:10:36","date_gmt":"2021-07-09T03:10:36","guid":{"rendered":"https:\/\/webdev.securin.xyz\/?p=7524"},"modified":"2023-04-05T12:39:09","modified_gmt":"2023-04-05T19:39:09","slug":"back-to-back-air-india-attacks-indicating-more-than-just-a-data-breach","status":"publish","type":"post","link":"https:\/\/10.42.32.162\/articles\/back-to-back-air-india-attacks-indicating-more-than-just-a-data-breach\/","title":{"rendered":"Back-to-Back Air India Attacks Indicating More than Just a Data Breach?"},"content":{"rendered":"
\n

The airline industry is on the brink of a supply chain attack from threat groups like APT41. Here is our analysis of the vulnerabilities that APT41 uses for such attacks.<\/p>\n<\/blockquote>\n

In early June 2021, Air India disclosed a cyber assault<\/a> on its network that began in February 2021, two months before the attack was identified. This disclosure came in the wake of a data breach announced in May 2021 as a result of an attack on SITA<\/a>\u2014an air travel solutions software popularly used by 90% of the world\u2019s travel industry.<\/p>\n

The events compromised around 10 years’ worth of data, with the personal information and credit card details of 4.5 million passengers exposed to the dark web. The attacks were traced back to a Chinese state-sponsored APT group, APT41, although the events are believed to be two separate incidents.<\/p>\n

Could Air India Have Avoided the Attacks?<\/strong><\/h2>\n

According to our research findings, there are 20 vulnerabilities associated with the APT41 threat group. If these vulnerabilities had been patched, both attacks could have been avoided.<\/strong><\/p>\n

\n

Securin warned about 15 of these vulnerabilities as part of its Cyber Risk in Working Remotely<\/a> (June 2020) and Ransomware Reports<\/a> published in February and May 2021.<\/p>\n<\/blockquote>\n

APT41\u2014Analysis<\/strong><\/h2>\n

We have been tracking Advanced Persistent Threat (APT) groups, their tactics and techniques, and the vulnerabilities they use to target their victims. Here are our findings.<\/p>\n

The threat actor behind the Air India and SITA attacks, APT41, has been out in the open since October 2012 and is of Chinese origin. It is also known as Bronze Atlas, Red Kelpie, Wicked Panda, Blackfly, Winnti, or Barium, and our research has uncovered 20 vulnerabilities that APT41 exploits to mount attacks.\u00a0\u00a0<\/strong><\/p>\n

\n

The analysis by Securin’s researchers indicates that the APT41 group prefers victim-specific multistage attacks, favoring the use of the Maze ransomware to take control and create maximum disruption.<\/p>\n<\/blockquote>\n\n\n\n
\n

\u00a0 \u00a0 \u00a0APT41\u2014Cheat Sheet<\/strong><\/h2>\n