The United States Department of Justice charged two Chinese hackers with global computer intrusion campaign to target intellectual property and confidential business information, including COVID-19 research. 

The indictment alleges two hackers worked with the Guangdong State Security Department (GSSD) of the Ministry of State Security (MSS), while also targeting victims worldwide for personal profit. The 11-count indictment alleges the hackers stole terabytes of data which comprised a sophisticated and prolific threat to U.S. networks in a hacking campaign that lasted more than ten years to the present, targeting companies in countries with high technology industries, including the United States, Australia, Belgium, Germany, Japan, Lithuania, the Netherlands, Spain, South Korea, Sweden, and the United Kingdom. 

Targeted industries included, among others, high tech manufacturing; medical device, civil, and industrial engineering; business, educational, and gaming software; solar energy; pharmaceuticals; defense.  In at least one instance, the hackers sought to extort cryptocurrency from a victim entity, by threatening to release the victim’s stolen source code on the Internet.  More recently, the defendants probed for vulnerabilities in computer networks of companies developing COVID-19 vaccines, testing technology, and treatments.

The hackers primarily exploited publicly known software vulnerabilities in popular web server software, web application development suites, and software collaboration programs. In some cases, those vulnerabilities were newly announced, meaning that many users would not have installed patches to correct the vulnerability. In addition, the Chinese hackers also targeted insecure default configurations in common applications and used their initial unauthorized access to place malicious web shell programs (e.g., the “China Chopper” web shell) and credential-stealing software on victim networks, which allowed them to remotely execute commands on victim computers.

To conceal the theft of information from victim networks and otherwise evade detection, the DOJ says the hackers typically packaged victim data in encrypted Roshal Archive Compressed files (RAR files), changed RAR file and victim documents’ names and extensions (e.g., from “.rar” to “.jpg”) and system timestamps, and concealed programs and documents at innocuous-seeming locations on victim networks and in victim networks’ “recycle bins.”  They also frequently returned to re-victimize companies, government entities, and organizations from which they had previously stolen data, in some cases years after the initial successful data theft.  In several instances, however, they were unsuccessful in this regard, due to the efforts of the FBI and network defenders, says the DOJ. 

“Today’s indictment demonstrates the serious consequences the Chinese MSS and its proxies will face if they continue to deploy malicious cyber tactics to either steal what they cannot create or silence what they do not want to hear,” said FBI Deputy Director David Bowdich. “Cybercrimes directed by the Chinese government’s intelligence services not only threaten the United States but also every other country that supports fair play, international norms, and the rule of law, and it also seriously undermines China's desire to become a respected leader in world affairs. The FBI and our international partners will not stand idly by to this threat, and we are committed to holding the Chinese government accountable.”