Anthem healthcare insurance hacker charged by FBI

US law enforcement pursuing China-based hackers for 11-month hacking campaign

Chinese hacker

The US Government has charged a Chinese man with helping to perpetuate a year-long cyber attack against US healthcare provider Anthem, as well as several other US businesses.

This is according to an indictment filed earlier this week, which charges 32-year-old Shenzhen resident Fujie Wang (AKA Dennis Wang) with four counts of conspiracy to commit fraud, identity theft and computer hacking. Also charged is another China-based individual, who remains unnamed but goes by aliases including Zhou Zhihong, Kim Young and Deniel Jack. Both are currently being pursued by the FBI.

The filing states that Wang and Jack participated in a hacking campaign lasting 11 months, from February 2014 to January 2015, using spearphishing tactics to gain access to Anthem and other victims. Anthem is the US' second-largest provider of health insurance, boasting more than 74 million customers according to its website, and with revenues exceeding $90 billion as of 2017.

The two individuals were "members of an extremely sophisticated hacking group operating in China", the indictment alleges, which was dubbed 'Black Vine' by Symantec researchers and is likely to be behind a string of attacks from 2012 onwards.

These attacks made heavy use of zero-day vulnerabilities in Microsoft's Internet Explorer, and focused on targets in the aerospace and energy industries. In the case of Anthem, the hackers eventually succeeded in making off with the personal data of almost 80 million people, including medical IDs, employment data, birthdays, social security numbers and more.

In yet another example of hackers exploiting supply-chain vulnerabilities, Wang and his co-conspirators used phishing emails to deploy malware on the network of one of Anthem's subsidiaries. The group then moved on to compromise the network of Anthem itself, eventually gaining access to the company's data warehouse and exfiltrating a large quantity of personal information via the use of Citrix's ShareFile transfer service.

Similar tactics were deployed by the group against three further victims. The companies in question have not been named, but operate in the technology, basic materials and communication services sectors, respectively.

Featured Resources

Preparing for AI-enabled cyber attacks

MIT technology review insights

Download now

Cloud storage performance analysis

Storage performance and value of the IONOS cloud Compute Engine

Download now

The Forrester Wave: Top security analytics platforms

The 11 providers that matter most and how they stack up

Download now

Harness data to reinvent your organisation

Build a data strategy for the next wave of cloud innovation

Download now

Recommended

Most employees put their workplace at risk by taking cyber security shortcuts
cyber security

Most employees put their workplace at risk by taking cyber security shortcuts

27 Jul 2021
New malware uses search engine ads to target pirate gamers
malware

New malware uses search engine ads to target pirate gamers

21 Jul 2021
61% of organizations say improving security a top priority for 2021
cyber security

61% of organizations say improving security a top priority for 2021

29 Jun 2021
ProtectedBy.AI’s CodeLock blocks malware at source code level
software as a service (SaaS)

ProtectedBy.AI’s CodeLock blocks malware at source code level

9 Jun 2021

Most Popular

RMIT to be first Australian university to implement AWS supercomputing facility
high-performance computing (HPC)

RMIT to be first Australian university to implement AWS supercomputing facility

28 Jul 2021
Samsung Galaxy S21 5G review: A rose-tinted experience
Mobile Phones

Samsung Galaxy S21 5G review: A rose-tinted experience

14 Jul 2021
Zyxel USG Flex 200 review: A timely and effective solution
Security

Zyxel USG Flex 200 review: A timely and effective solution

28 Jul 2021