Chinese Hackers Charged in Decade-Long Crime and Spying Spree

Li Xiaoyu had a problem. At some point in his decade-long hacking spree with former college classmate Dong Jiazhi, as alleged in a recent Justice Department indictment, the Chinese national found himself unable to break into the mail server of a Burmese human rights group. The usual methods apparently hadn’t worked. For Li, the solution came from having a friend in high places: An officer with China’s Ministry of State Security handed him zero-day malware—unknown to security vendors, and so harder to defend against—to help finish off the job.

Other countries have long blurred the lines between criminal and state-sponsored hacking, particularly Russia, Iran, and North Korea. But in a detailed indictment unsealed by the Department of Justice Tuesday, the United States has for the first time officially accused China of belonging to that club. Since at least 2009, authorities say, Li and Dong have hacked hundreds of companies around the world. Their targets range from manufacturing and engineering companies to videogame and education software to solar energy to pharmaceuticals. More recently—and unsurprisingly, given the intense international interest—the pair has targeted firms working on Covid-19 vaccines and treatments. They’ve allegedly stolen invaluable intellectual property to pass along to their MSS handlers, while lining their own pockets along the way.

“China is using cyberintrusions as part of its rob, replicate, and replace strategy to technological development,” said assistant attorney general for national security John Demers at a press conference Tuesday. “China is providing a safe haven for criminal hackers who, as in this case, are hacking in part for their own personal gain, but willing to help the state and on call to do so.”

The indictment outlines at length how Li and Dong allegedly worked as a tag team. Dong would research victims and how they might be exploited; Li did the dirty work of compromising the networks and exfiltrating the data. The pair used the same general workflow regardless of the victim, which makes sense given the volume of attacks to which they have been linked. Efficiency at scale counts for a lot.

useful reference
this page
Get More Info
see here
this website
great post to read
my company
imp source
click to read more
find more info
see it here
Homepage
a fantastic read
find this
Bonuses
read this article
click here now
browse this site
check here
original site
my response
pop over to these guys
my site
dig this
i thought about this
check this link right here now
his explanation
why not try these out
more info here
official site
look at this site
check it out
visit
click for more info
check these guys out
view publisher site
Get More Information
you can try this out
see this
learn this here now
directory
why not find out more
navigate to these guys
see this here
check my site
anchor
other
additional hints
look at this web-site
their explanation
internet
find more
Read More Here
here
Visit Website
hop over to this website
click
her latest blog
This Site
read review
try here
Clicking Here
page
read this post here
More Bonuses
recommended you read
go to this web-site
this
check that
Go Here
More hints
you could check here
Continued
More Help
try this
you could try here
website here
useful source
read the full info here
Discover More

First, they would identify high-value targets, and attempt to get a foothold either through poorly configured networks or through fresh vulnerabilities that their targets hadn’t yet patched. On September 11, 2018, for instance, Adobe disclosed a critical bug in its ColdFusion platform; by October 20 of that year, Li had successfully exploited it to install a so-called web shell on the network of a US government biomedical research agency in Maryland.

Web shells were endemic to Li and Dong’s efforts, particularly one called “China Chopper,” a widely available and relatively simple tool that provided the attackers with remote access to targeted networks. The hackers would also run credential-stealing software to grab user names and passwords. Once they had sufficient visibility into a victim’s systems, they would amass the data they wanted to steal into a compressed RAR file.

Court documents outline certain steps the hackers took to hide their activity from there, like working primarily out of the “recycle bin” folder, which Windows hides by default. They would also give their web shells and RAR files innocuous names, such as changing an extension to “.jpg” to make it look like a simple image rather than dozens or even hundreds of gigabytes of intellectual property.

The indictment contains only a fraction of the heists Li and Dong are linked to, but shows an impressive breadth of work. They allegedly stole 200GB from a California firm, including radio, laser, and antennae technology. Another 140GB from a Virginia defense contractor, comprising both details of projects for the US Air Force and the personal information of hundreds of employees and contractors. Over a terabyte of data from a mechanical engineering company at work on high-efficiency gas turbines. Not to mention a hit list that included multiple videogame and pharmaceutical companies, an educational software firm, Covid-19 research, and hundreds of other victims worldwide.

In some cases, it seems unclear whether Li and Dong were acting on their own behalf or that of the Chinese government. In others, the lines are drawn more brightly. They allegedly stole emails between a dissident and former Tiananmen Square protestor and the Dalai Llama’s office, which would have not clear financial value but plenty of intrigue for the Chinese government. At the other extreme, they allegedly sent a email in 2017 to several employees of a Massachusetts software company with the subject line “Source Code To Be Leaked!” and demanded a $15,000 cryptocurrency payoff.

Leave a Reply

Your email address will not be published. Required fields are marked *