Chinese Hackers Exploit VSCode Tunnels: Microsoft’s Development Tool Turned Cyber Backdoor
Chinese hackers are using Visual Studio Code backdoor tactics to maintain stealthy access to IT systems in Southern Europe. By abusing Microsoft’s Remote Development feature, they create undetectable tunnels through Azure, raising concerns over this rare method. Security experts advise vigilance over suspicious VSCode launches and unexpected connections.
Hot Take:
When hackers start using your favorite coding tool as a backdoor, it’s like discovering your grandma has a secret life as a rollerblading ninja. VSCode tunnels, how could you betray us like this? It’s almost as if hackers are saying, “Why hack the planet when you can just hack your IDE?”
Key Points:
- Chinese hackers are using VSCode tunnels to maintain access to compromised systems.
- The campaign, known as Operation Digital Eye, was observed in June and July 2024.
- This tactic involves exploiting Microsoft’s legitimate infrastructure, making detection challenging.
- Initial access was gained through SQL injection and expanded using a PHP webshell called PHPsert.
- The exact threat actor remains undetermined, but suspicions point weakly at STORM-0866 or Sandman APT.
Already a member? Log in here