Denmark Faces Largest Cybersecurity Incident to Date

The attackers orchestrated a sophisticated attack by exploiting a known vulnerability, CVE-2023-28771, which is present in Zyxel firewalls. The attackers sent a single crafted data packet to port 500 over UDP, exploiting the vulnerability within the Zyxel device’s Internet Key Exchange (IKE) packet decoder. This action allowed the attackers to gain root privileges and the ability to execute commands directly on the device. The attackers executed the following code on the firewalls: ‘zysh -p 100 -e ’show username’;zysh -p 100 -e ’show running-config’, collecting current usernames and configuration settings. SektorCERT’s report stated that multiple companies were attacked simultaneously, and the attackers showed flawless precision in selecting specific targets (SektorCERT, 2023). The timing of the attack was strategic, targeting companies that had out of date firewalls. The compromised firewalls were then used to act as a part of Mirai and MooBot botnets, launching a distributed denial-of-service (DDoS) attack against U.S. and Hong Kong companies (The Hacker News, 2023). The attackers had knowledge of undisclosed vulnerabilities in the Zyxel firmware to launch this DDoS attack. Zyxel later disclosed the vulnerabilities, CVE-2023-33009 and CVE-2023-33010, a few days after the attack. After the compromise, SektorCERT stated that they had identified a single 1340-byte packet from a known Sandworm IP address, utilizing the “one ping only” method to minimize their digital footprint. After the exploited vulnerabilities became public, it was reported that there was a surge in attacks originating from IP addresses in Poland and Ukraine. The attackers changed their tactics from precision planning to widespread assaults, resulting in affected entities disconnecting themselves from the internet and going into island mode as a safeguarding measure.