Chinese APT40 hackers hijack SOHO routers to launch attacks

A joint advisory from multiple international cybersecurity agencies details APT40 (Kryptonite Panda)'s cyber-espionage operations: rapid exploitation of disclosed vulnerabilities (e.g., Log4J, Confluence, ProxyLogon), hijacking end-of-life SOHO routers to proxy malicious traffic, deploying web shells for persistence, harvesting credentials via Kerberoasting, conducting RDP lateral movement and SMB exfiltration to C2 servers; the report includes two 2022 case studies and prescribes mitigations such as timely patching, network segmentation, MFA, disabling unused services, and replacing EoL networking gear.