China accused of 10-year cyber crime campaign

Were attacks across Southeast Asia sponsored by the Chinese government?

China stands accused of conducting a decade-long cyber warfare campaign against governments and companies in Southeast Asia and India.

The allegations come from security organisation FireEye, which claims the attacks date back to at least 2005, linking the perpetrators - dubbed ATP30 - to China.

FireEye's report, ATP30 and the Mechanics of a Long-running Cyber Espionage Operation, identified targets as government and commercial entities holding "key political, economic and military information about the region".

It read: "This activity is state sponsoredmost likely by the Chinese government. The group expresses a distinct interest in organizations and governments associated with the Association of Southeast Asian Nations (ASEAN).

Advertisement
Advertisement - Article continues below
Advertisement - Article continues below

"APT30 is most likely trying to compromise ASEAN members or associates to steal information that would provide insight into the region's politics and economics."

The report also found that the group was highly sophisticated, using self-updating, systematically labelled and organised malware, adding that the developers supporting the malware attacks work as part of a "collaborative team environment".

Through examining the malware's controller software, it is evident that the attackers have been selecting specific, high-priority targets as part of a "consistent long-term mission".

This mission would appear to be the interception and theft of classified data, indicated by the group's ability to infect air-gapped' networks servers that have been isolated or taken offline for security reasons.

All of this information indicates a motivation very different from that of most hackers.

The majority of malicious network intrusions are done with a view to stealing directly profitable information such as credit card or banking credentials, or ransomable corporate secrets. They also often use smash-and-grab tactics to gain the maximum amount of data possible, sifting through it after the fact.

Advertisement - Article continues below

ATP30, on the other hand, use meta-data and low-profile intrusion to pre-select specific files on a target network before they steal them.

The files selected have frequently been related to major shifts in the Southeast Asian political landscape, but have also focused on journalistic outlets that have been openly critical of the Chinese government.

The operation as a whole bears many hallmarks of Chinese state sponsorship, FireEye said, claiming it appears directly aimed at "targets that pose a potential threat to the influence and legitimacy of the Chinese Communist Party".

Like the recent MitM attack against Google and Github DDoS, it is unlikely that official Chinese involvement will be proved.

However, it is becoming increasingly difficult to deny that China is engaged in illegal cyberattacks against its enemies. The US's National Intelligence agency recently accused China of stealing intellectual property and exploiting networks.

Featured Resources

What you need to know about migrating to SAP S/4HANA

Factors to assess how and when to begin migration

Download now

Your enterprise cloud solutions guide

Infrastructure designed to meet your company's IT needs for next-generation cloud applications

Download now

Testing for compliance just became easier

How you can use technology to ensure compliance in your organisation

Download now

Best practices for implementing security awareness training

How to develop a security awareness programme that will actually change behaviour

Download now
Advertisement

Recommended

Visit/security/internet-security/354417/avast-and-avg-extensions-pulled-from-chrome
internet security

Avast and AVG extensions pulled from Chrome

19 Dec 2019
Visit/security/354156/google-confirms-android-cameras-can-be-hijacked-to-spy-on-you
Security

Google confirms Android cameras can be hijacked to spy on you

20 Nov 2019

Most Popular

Visit/policy-legislation/data-governance/354496/brexit-security-talks-under-threat-after-uk-accused-of
data governance

Brexit security talks under threat after UK accused of illegally copying Schengen data

10 Jan 2020
Visit/security/cyber-security/354468/if-not-passwords-then-what
cyber security

If not passwords then what?

8 Jan 2020
Visit/policy-legislation/31772/gdpr-and-brexit-how-will-one-affect-the-other
Policy & legislation

GDPR and Brexit: How will one affect the other?

9 Jan 2020
Visit/web-browser/30394/what-is-http-error-503-and-how-do-you-fix-it
web browser

What is HTTP error 503 and how do you fix it?

7 Jan 2020