Chinese spies spent months inside aerospace engineering firm's network via legacy IT

A Chinese state-sponsored APT gained access to a US-headquartered engineering manufacturer's network by exploiting an exposed IBM AIX server running an Apache Axis admin portal with default credentials. Operators installed an AxisInvoker web shell, harvested Kerberos data and added SSH keys for persistence, then expanded into the Windows environment using NTLM relay, Cobalt Strike, and a fast-reverse proxy to enumerate and attempt credential theft; the intrusion persisted for roughly four months before detection and removal, raising significant supply-chain and intellectual-property theft concerns.