Uncle Sam fingers two Chinese men for hacking tech, aerospace, defense on behalf of Beijing

American prosecutors have accused two men, linked to the Chinese government, of conspiring to hack dozens of cloud giants, aerospace and defense companies, chip designers, and other organizations globally, to swipe blueprints and other secrets.

The two men, Zhu Hua (朱华) – whose online identities are said to include Afwar, CVNX, Alayos, and Godkiller – and Zhang Shilong (张士龙) – whose aliases are said to include Baobeilong, Zhang Jianguo, and Atreexp – are alleged to be part of a hacker gang referred to as APT10, among other names. They’re charged with conspiracy to commit computer intrusions, wire fraud, and aggravated identity theft.

APT stands for Advanced Persistent Threat, a trendy term for malware and exploit code that requires some skill to create. As is usual in the mildly cartoonish world of cybersecurity, APT10 has been referred to as Stone Panda, MenuPass and Red Apollo.

“This case is significant because the defendants are accused of targeting and compromising managed service providers, or MSPs,” said Deputy Attorney General Rod Rosenstein in a statement today. “MSPs are firms that other companies trust to store, process, and protect commercial data, including intellectual property and other confidential business information. When hackers gain access to MSPs, they can steal sensitive business information that gives competitors an unfair advantage.”

According to Rosenstein, over 90 per cent of US Justice Dept cases alleging economic espionage over the past seven years involve China.

‘Trade secrets and economies’

The UK government publicly echoed the US charges. “This campaign is one of the most significant and widespread cyber intrusions against the UK and allies uncovered to date, targeting trade secrets and economies around the world,” said UK Foreign Secretary Jeremy Hunt.

The UK’s Government Communications Headquarters (GCHQ), through its public-facing National Cyber Security Centre (NCSC) offshoot, said APT10 had “targeted healthcare, defense, aerospace, government, heavy industry/mining, Managed Service Providers (MSPs) and IT industries, among many other sectors.”

The NCSC also warned that APT10’s intellectual property theft is “current,” having been “facilitated by the group’s targeting of MSPs” – and added that “in some cases basic cyber security measures are still not being taken, and this is not acceptable.”

The US Energy Department also chimed in to scold the Chinese government and APT10. “Malicious actors are conducting sophisticated attacks to threaten our nation’s critical infrastructure,” said Secretary of Energy Rick Perry in a statement.

And the FBI put the defendants on a wanted poster.

Coordinated

The US indictment claims the two men worked for a company called Huaying Haitai in Tianjin, China, and acted in coordination with the Chinese Ministry of State Security’s Tianjin State Security Bureau.

From 2006 through 2018, a criminal indictment states, members of the APT10 group, including the defendants, broke into the computer systems of commercial and defense tech companies, and US government agencies. They allegedly penetrated more than 45 such organizations in at least 12 states. They’re said to have stolen gigabytes of data from organizations involved in aerospace, satellites, manufacturing, pharmaceuticals, oil and gas exploration and production, communications, and computer processors.

Starting in 2014, the group is said to have focused on MSPs. The indictment says APT10 and the defendants compromised a service provider with offices in New York and clients in at least 12 countries including Brazil, Canada, Finland, France, Germany, India, Japan, Sweden, Switzerland, the United Arab Emirates, the United Kingdom and the United States.

APT10 is also blamed for breaking into US Navy computer systems and stealing confidential data, including personal information for 100,000 Naval personnel. NASA was among the government agencies affected.

In 2013, APT10, as MenuPass, was targeting defense contractors, while accounts ‘n’ audits firm PricewaterhouseCoopers (PWC) and BAE Systems jointly called out APT10’s Chinese links almost 18 months ago.

The indictment outlines APT10’s attack strategy, which included individually targeted phishing emails (spear phishing) with attachments that, when opened, installed and ran spyware and other data-stealing software nasties.

The group often used the QuasarRAT remote admin malware. Once inside a network, the hackers would extract documents – not only intellectual property and valuable commercial files but also personal data of staff, contractors and business contacts, usually by zipping them into a .rar file.

GCHQ’s summary (PDF, 6 pages) of APT10’s tactics said: “Industry partners have reported that data exfiltrated often relates to human resources information, suggesting an interest in the targeted company specifically, as well as potentially developing access to customers and suppliers.”

It also listed IP addresses that the NCSC had definitely linked to the advanced persistent threat crew’s command and control servers, ready for alert IT bods to block:

• 185.111.74.127
• 194.68.44.108
• 66.70.135.104
• 185.211.247.52
• 195.54.163.74
• 167.114.171.8
• 37.10.71.100

The Justice Department’s name-and-shame strategy echoes its 2014 indictment of five members of the Chinese military for cyber attacks. Those five have yet to be apprehended.

While the FBI said Zhu Hua and Zhang Shilong can be arrested if they travel outside China, Rosenstein made clear in his remarks that America doesn’t expect the two to appear before a US judge any time soon. China has no extradition agreement with the US, and ongoing trade conflict between the two countries, exacerbated by the recent arrest of a Huawei executive in Canada at the behest of the US, makes any sort of accord look unlikely.

“We hope the day will come when the defendants face justice under the rule of law in a federal courtroom,” said Rosenstein. “Until then, they and other hackers who steal from our companies for the apparent benefit of Chinese industries should remember: There is no free pass to violate American laws merely because they do so under the protection of a foreign state.”

There’s no real penalty either. ®

READ MORE HERE