Skip to main content

Court Charges Two Chinese Hackers for Targeting COVID-19 Research and Trade Secrets.





The U.S. Department of Justice (DoJ) has revealed charges against two Chinese nationals for their alleged involvement in a decade-long hacking spree targeting dissidents, government agencies, and hundreds of organizations in as many as 11 countries.

The 11-count indictment, which was unsealed on Tuesday, alleges LI Xiaoyu (李啸宇) and DONG Jiazhi (董家志) stole terabytes of sensitive data, including from companies developing COVID-19 vaccines, testing technology, and treatments while operating both for private financial gain and behalf of China's Ministry of State Security.
"China has now taken its place, alongside Russia, Iran and North Korea, in that shameful club of nations that provide a safe haven for cyber criminals in exchange for those criminals being 'on call' to work for the benefit of the state, [and] to feed the Chinese Communist party's insatiable hunger for American and other non-Chinese companies' hard-earned intellectual property, including COVID-19 research," said Assistant Attorney General John C. Demers, who leads the DoJ's National Security Division.
The pair, who are currently wanted by the U.S. Federal Bureau of Investigation, came under the radar after they compromised a U.S. Department of Energy network in Hanford, which is home to a decommissioned nuclear production complex located in the state of Washington.
Aside from this breach, the individuals in questions have been accused of infiltrating the networks of companies spanning high tech manufacturing, industrial engineering, defense, educational, gaming software, and pharmaceutical sectors with an aim to steal trade secrets and other confidential business information.
Besides the U.S., a number of victim organizations are based in Australia, Belgium, Germany, Japan, Lithuania, the Netherlands, Spain, South Korea, Sweden, and the U.K. In all, the targeted cyberattacks lasted over a period of more than ten years, starting around September 1, 2009, and continuing through July 7, 2020, the DoJ said.
Exploiting Unpatched Vulnerabilities in Web Applications
According to the indictment, the hackers gained an initial foothold to the companies by exploiting insecure default configurations or freshly disclosed security flaws in popular software that hadn't yet been patched.
The two suspects, then, installed credential-stealing software to gain deeper access and leveraged web shells to execute malicious programs, and transfer the data in the form of compressed RAR files, but not before changing their extensions to ".JPG" to mask the exfiltration process in the form of innocuous images.
The stolen data, which ran into hundreds of gigabytes, consisted of source code, information about drugs under active development, weapon designs, and personally identifiable information, the DoJ noted.
What's more, all the malicious activities were performed on the Recycle Bin of the targeted Windows systems, using it to load the executables into specific folders and save the RAR files.
"In at least one instance, the hackers sought to extort cryptocurrency from a victim entity, by threatening to release the victim's stolen source code on the Internet," the DoJ said. "More recently, the defendants probed for vulnerabilities in computer networks of companies developing COVID-19 vaccines, testing technology, and treatments."
It's Not Just China
The development is all the more significant since it comes just months after both the FBI and Homeland Security warned that China was actively trying to steal data from organizations working on COVID-19 research and amid mounting tensions between the U.S. and China over national security concerns.
But China isn't the only nation that's been accused of using its offensive cyber capabilities to steal coronavirus research.
In May, Iran-backed hackers purportedly targeted U.S. drugmaker Gilead, whose antiviral drug remdesivir has been proven to trigger an immune response in patients infected with COVID-19.
Then last week, the U.K.'s National Cyber Security Centre (NCSC) alleged that hackers linked to Russian intelligence services (APT29 or CozyBear) had targeted companies researching a coronavirus vaccine in the U.S., U.K., and Canada without specifying which organizations had been targeted, or whether any information had been stolen. Russia has denied the allegations.
Li and Dong are charged with identity theft, conspiracy to commit wire fraud, theft of trade secrets, and violating anti-hacking laws, all of which collectively carry a maximum sentence of over 40 years.




Comments

Popular posts from this blog

UGANDA ELECTORAL COMMISSION TO ELIMINATE NATIONAL IDENTIFICATION CARDS (IDs) FOR 2021 GENERAL ELECTIONS.

The elimination of using National IDs (Ndagamuntu) for the 2021 elections should not have come as a surprise. One would be very NAIVE to think that Bobi Wine has not prepared for this in his Business Plan under the RISK section. It is public knowledge that our EC is not independent.  It is also public knowledge that Military Dictator Yoweri Museveni will never lose an election. What stunned us this morning is when we noticed that on social media, people were mocking Bobi with his "get your Ndagamuntu".  We are on record for saying to all Our readers that the National ID is like Apartheid in South Africa. Students of History would know how those IDs were being used to arrest people, deny them jobs, deny them basic services. Consequently, Bobi was not wrong and will never be wrong on the Ndagamuntu. Except the ones attacking him and mocking him forget that in Uganda, now, no National ID (Ndagamuntu), no service.  If you have not been denied registering your child i...

Here is Why Our Utterances For Praying Jesus And God To Come Liberate Ugandans, May Be Misplaced. This Phrase is like inform of a Letter To Some Categorized Section Of Ugandans.

https://m.facebook.com/yusufosuta/photos/a.1896701010557789/2070383359856219/?type=3 OPEN LETTER TO NRM SUPPORTERS - NATIONAL ROBBERS MOVEMENT. .................................................................................. Last week of March, a friend told me to pray for Uganda.  I told him that he was an Idiot and we have prayed for too long and we are still hungry and sick and Jesus is not coming soon to liberate us. He then ignored the STUPID and sent me a picture we all now know.  It got me totally messed up.  This guy was telling me to pray then sends a picture of men bowing down in blood.  He might have meant guns but I blocked him because his utterances of praying for Uganda were misplaced. I unblocked him 3 weeks later and asked him about praying and assassinations.  His reply "eithrr prayers or guns or both". I hate violence with a passion.  So he is now blocked in like FOREVER. Do you feel safe?  Do not feel safe. Uganda regim...

CAN I CHANGE MY MIND ABOUT THE INHERITANCE I RECEIVED AND ASK FOR SOMETHING ELSE ?.

#iip_updates . #Information_is_Power . Read more here https://informationispowah.blogspot.com/2023/07/can-i-change-my-mind-about-inheritance.html in the link. #we_inform_the_uninformed . Okello lost his wife 20 years ago and decided to only focus on their Mateo, Yona and Yosefu. 20 years later, Okello had 7 acres of land, a successful poultry business, and sinotrucks for hire. Early this year, Okello got a call telling him that one of his trucks knocked a boda boda. Okello decided to rush to see if he could sort it out before police became involved. Unfortunately, he never made it, as he was entering the main road, another trailer rammed into him and killed him instantly.   After Okello had been laid to rest, his sons sat down and divided the property amongst themselves. However, of late, Yosefu the last born has started complaining that he was cheated, and he wants to be given something else because most of the chicken in the chicken business died of a fever.   Can ...