Charges levied against Chinese hackers accused of stealing COVID-19 info and more international secrets
Yesterday, the United States Department of Justice reported that a federal grand jury in Spokane, Washington, returned an indictment charging two hackers, both nationals and residents of the People’s Republic of China, with hacking into the computer systems of hundreds of victim companies, governments, non-governmental organizations, and individual dissidents, clergy, and democratic and human rights activists in the United States and abroad, including Hong Kong and China.
The two hackers in some instances acted for their own personal financial gain, and in others for the benefit of the MSS or other Chinese government agencies. They allegedly stole terabytes of data which comprised a sophisticated and prolific threat to U.S. networks. And that hacking began more than 10 years ago.
The 11-count indictment alleges Li Xiaoyu (李啸宇), 34, and Dong Jiazhi (董家志), 33, who were trained in computer applications technologies at the same Chinese university, conducted a hacking campaign lasting more than ten years to the present, targeting companies in countries with high technology industries, including the United States, Australia, Belgium, Germany, Japan, Lithuania, the Netherlands, Spain, South Korea, Sweden, and the United Kingdom.
Targeted industries included, among others, high tech manufacturing; medical device, civil, and industrial engineering; business, educational, and gaming software; solar energy; pharmaceuticals; defense. In at least one instance, the hackers sought to extort cryptocurrency from a victim entity, by threatening to release the victim’s stolen source code on the Internet. More recently, the defendants probed for vulnerabilities in computer networks of companies developing COVID-19 vaccines, testing technology, and treatments.
“China has now taken its place, alongside Russia, Iran and North Korea, in that shameful club of nations that provide a safe haven for cyber criminals in exchange for those criminals being ‘on call’ to work for the benefit of the state, here to feed the Chinese Communist party’s insatiable hunger for American and other non-Chinese companies’ hard-earned intellectual property, including COVID-19 research,” said Assistant Attorney General for National Security John C. Demers.
According to the indictment, to gain initial access to victim networks, the defendants primarily exploited publicly known software vulnerabilities in popular web server software, web application development suites, and software collaboration programs. In some cases, those vulnerabilities were newly announced, meaning that many users would not have installed patches to correct the vulnerability. The defendants also targeted insecure default configurations in common applications.
The defendants used their initial unauthorized access to place malicious web shell programs (e.g., the “China Chopper” web shell) and credential-stealing software on victim networks, which allowed them to remotely execute commands on victim computers.
To conceal the theft of information from victim networks and otherwise evade detection, the defendants typically packaged victim data in encrypted Roshal Archive Compressed files (RAR files), changed RAR file and victim documents’ names and extensions (e.g., from “.rar” to “.jpg”) and system timestamps, and concealed programs and documents at innocuous-seeming locations on victim networks and in victim networks’ “recycle bins.”
The two frequently returned to re-victimize companies, government entities, and organizations from which they had previously stolen data, in some cases years after the initial successful data theft.
The indictment charges Li and Dong with conspiring to steal trade secrets from at least eight known victims. Those secrets consisted of technology designs, manufacturing processes, test mechanisms and results, source code, and pharmaceutical chemical structures. Such information would give competitors with a market edge by providing insight into proprietary business plans and savings on research and development costs in creating competing products.
Li and Dong are each charged with:
- one count of conspiracy to commit computer fraud, which carries a maximum sentence of five years in prison;
- one count of conspiracy to commit theft of trade secrets, which carries a maximum sentence of ten years in prison;
- one count of conspiracy to commit wire fraud, which carries a maximum sentence of 20 years in prison;
- one count of unauthorized access of a computer, which carries a maximum sentence of five years in prison; and
- seven counts of aggravated identity theft, which each carries a mandatory sentence of two non-consecutive years in prison.
Unfortunately, the two hackers are presumed to be alive and well and living in China, well beyond the reach of U.S. law enforcement.
The two defendants are not in custody, and federal officials conceded Tuesday that they were not likely to step foot in an American courtroom. ~ Fox News
(Cover Image: 7/21/2020, FBI Deputy Director David Bowdich announces charges against Chinese hackers Li Xiaoyu and Dong Jiazhi, Image credit: FBI)
(Source: DOJ)
~ Posted by Richard Webster, Ace News Today / Connect with Richard on Facebook and Twitter
