Do you have any questions? Contact us here
US Charges 2 Chinese Hackers for Targeting COVID-19 Research and Trade Secrets
The U.S. Department of Justice (DoJ) yesterday revealed charges against two Chinese nationals for their alleged involvement in a decade-long hacking spree targeting dissidents, government agencies, and hundreds of organizations in as many as 11 countries.
The 11-count indictment, which was unsealed on Tuesday, alleges LI Xiaoyu (李啸宇) and DONG Jiazhi (董家志) stole terabytes of sensitive data, including from companies developing COVID-19 vaccines, testing technology, and treatments while operating both for private financial gain and behalf of China’s Ministry of State Security.
“China has now taken its place, alongside Russia, Iran and North Korea, in that shameful club of nations that provide a safe haven for cyber criminals in exchange for those criminals being ‘on call’ to work for the benefit of the state, [and] to feed the Chinese Communist party’s insatiable hunger for American and other non-Chinese companies’ hard-earned intellectual property, including COVID-19 research,” said Assistant Attorney General John C. Demers, who leads the DoJ’s National Security Division.
The pair, who are currently wanted by the U.S. Federal Bureau of Investigation, came under the radar after they compromised a U.S. Department of Energy network in Hanford, which is home to a decommissioned nuclear production complex located in the state of Washington.
Aside from this breach, the individuals in questions have been accused of infiltrating the networks of companies spanning high tech manufacturing, industrial engineering, defense, educational, gaming software, and pharmaceutical sectors with an aim to steal trade secrets and other confidential business information.
Besides the U.S., a number of victim organizations are based in Australia, Belgium, Germany, Japan, Lithuania, the Netherlands, Spain, South Korea, Sweden, and the U.K. In all, the targeted cyberattacks lasted over a period of more than ten years, starting around September 1, 2009, and continuing through July 7, 2020, the DoJ said.
According to the indictment, the hackers gained an initial foothold to the companies by exploiting insecure default configurations or freshly disclosed security flaws in popular software that hadn’t yet been patched.
The two suspects, then, installed credential-stealing software to gain deeper access and leveraged web shells to execute malicious programs, and transfer the data in the form of compressed RAR files, but not before changing their extensions to “.JPG” to mask the exfiltration process in the form of innocuous images.
The stolen data, which ran into hundreds of gigabytes, consisted of source code, information about drugs under active development, weapon designs, and personally identifiable information, the DoJ noted.