Vast cyber espionage campaign linked to China: report

Vast cyber espionage campaign linked to China: report

Online attackers with clear links to China are behind a vast cyber espionage campaign targeting government agencies of interest to Beijing, Google subsidiary Mandiant said on Thursday.

"This is the broadest cyber espionage campaign known to be conducted by a China-nexus threat actor since the mass exploitation of Microsoft Exchange in early 2021," said Mandiant chief technology officer Charles Carmakal.

The cyberattackers compromised the computer defenses of hundreds of organizations, in some cases stealing "emails of prominent employees dealing in matters of interest to the Chinese government," Carmakal added.

Mandiant reported having "high confidence" that a group referred to as UNC4841 was behind the wide-ranging espionage campaign "in support of the People's Republic of China".

The hackers targeted victims in at least 16 different countries, striking organizations in the public and private sectors worldwide, the report said.

Read also

Vietnam's power crisis hits local firms, foreign investors

The targeting focused on issues of high policy importance to the Chinese government, particularly in the Asia-Pacific region and Taiwan, according to the report.

Victims included foreign ministries, research organizations, and foreign trade missions based in Hong Kong and Taiwan, Mandiant said in its findings.

PAY ATTENTION: Join Legit.ng Telegram channel! Never miss important updates!

The attacks involved email messages booby-trapped with malicious code and exploited a vulnerability in Barracuda software for screening such missives to make sure they are safe, according to the report.

The cyber espionage activity was detected in May and is believed to have started as early as October of last year.

"We continue to see evidence of ongoing malware activity" on some systems that were compromised, Barracuda Networks told AFP.

Perennial issue

The 2021 hack of Microsoft Exchange, which security researchers attributed to a Beijing-backed group, affected at least 30,000 organizations in the United States including businesses and local governments.

Read also

US clampdown has crypto kings looking abroad

Washington has frequently accused Beijing of cyberattacks against US targets, with the issue contributing to a deterioration in relations between the two powers in recent years.

China has consistently denied the claims, and has railed against alleged US cyber espionage, last year accusing the US National Security Agency of carrying out "tens of thousands of malicious attacks on network targets in China".

The latest hacking revelations come as Secretary of State Antony Blinken heads to China for talks on Sunday and Monday, the first visit by a top US diplomat in nearly five years.

A senior State Department official said the trip is aimed at helping the two countries manage their "competition" responsibly, and "at a minimum, reduce the risk of miscalculation so that we do not veer into potential conflict".

Meanwhile, in an apparently unrelated cyberattack, CNN reported Thursday that several US federal agencies had been caught in a Russian group's hack of the commonly used software MOVEit.

Read also

AIIB serves China's Communist Party: Canadian former executive

When asked for comment by AFP, the White House pointed to an advisory issued last week by the FBI and CISA, the federal government's lead cybersecurity agency, warning of the software's vulnerability and offering information on how to mitigate it.

ube/gc/arp/des/mlm/smw/dhw

© Agence France-Presse

Source: AFP

Authors:
AFP avatar

AFP AFP text, photo, graphic, audio or video material shall not be published, broadcast, rewritten for broadcast or publication or redistributed directly or indirectly in any medium. AFP news material may not be stored in whole or in part in a computer or otherwise except for personal and non-commercial use. AFP will not be held liable for any delays, inaccuracies, errors or omissions in any AFP news material or in transmission or delivery of all or any part thereof or for any damages whatsoever. As a newswire service, AFP does not obtain releases from subjects, individuals, groups or entities contained in its photographs, videos, graphics or quoted in its texts. Further, no clearance is obtained from the owners of any trademarks or copyrighted materials whose marks and materials are included in AFP material. Therefore you will be solely responsible for obtaining any and all necessary releases from whatever individuals and/or entities necessary for any uses of AFP material.