Chinese Cyber-Hacking Ring Charged for Attacking Americans in 14-Year-Long Email Operation
Chinese Cyber-Hacking Ring Charged for Attacking Americans in 14-Year-Long Email Operation
The United States Justice Department unsealed charges Monday, March 25, against seven Chinese nationals working for the Chinese government to enact a widespread cyber-hacking campaign.
The Justice Department said hackers targeted American and foreign critics of China, businesses, journalists and politicians in a 14-year-long operation, Knewz.com has learned.
The indictment was entered on January 30 but wasn’t unsealed until March 25. The men have been charged with conspiracy to commit computer intrusions and conspiracy to commit wire fraud for their involvement in a People’s Republic of China (PRC)-based hacking enterprise.
The defendants are Ni Gaobin, 38; Weng Ming, 37; Cheng Feng, 34; Peng Yaowen, 38; Sun Xiaohui, 38; Xiong Wang, 35; and Zhao Guangzong, 38. All are believed to reside in China.
Attorney General Merrick Garland said in a statement: “The Justice Department will not tolerate efforts by China's government to intimidate Americans who serve the public, silence the dissidents who are protected by American laws or steal from American businesses. This case serves as a reminder of the ends to which the Chinese government is willing to go to target and intimidate its critics, including launching malicious cyber operations aimed at threatening the national security of the United States and our allies.”
According to the indictment, the global hacking operation spawned 10,000 malicious emails backed by the Chinese government and targeted journalists, political officials and companies.
Deputy Attorney General Lisa Monaco said the ongoing operation was designed to “repress critics of the Chinese regime, compromise government institutions, and steal trade secrets.”
Along with the seven defendants, dozens of identified PRC Ministry of State Security (MSS) intelligence officers, contractor hackers and support personnel were part of the hacking group known as Advanced Persistent Threat 31 (the APT31 Group) - a cyberespionage program run by the MSS’s Hubei State Security Department in Wuhan.
The more than 10,000 malicious emails sent to these targets often appeared to be from prominent news outlets or journalists and appeared to contain legitimate news articles.
The malicious emails contained hidden tracking links. The recipient only had to open the email, and information about them, including their location, internet protocol (IP) addresses, network schematics, and specific devices used to access pertinent email accounts, was transmitted to a server controlled by the defendants and those working with them.
They then used that information to launch more direct and sophisticated targeted hacking, such as compromising the recipients’ home routers and other electronic devices.
Tracking link emails were also sent to government officials around the world who had criticized the Chinese government. The targets included every European Union member of the Inter Parliamentary Alliance on China (IPAC), and 43 United Kingdom parliamentary accounts, most of whom were members IPAC or had been outspoken on topics relating to the PRC government.
Targeted U.S. government officials included individuals working in the White House, at the Departments of Justice, Commerce, Treasury, and State, and U.S. Senators and Representatives of both political parties. Private companies attacked included defense contractors who provide services to the US military and "a leading provider of 5G network equipment," the Justice Department said.
FBI Director Christopher Wray said: "Today's announcement exposes China's continuous and brash efforts to undermine our nation's cybersecurity and target Americans and our innovation. As long as China continues to target the US and our partners, the FBI will continue to send a clear message that cyber espionage will not be tolerated, and we will tirelessly pursue those who threaten our nation’s security and prosperity. This indictment underscores our unwavering commitment to disrupt and deter malicious cyber activity, and safeguard our citizens, businesses, and critical infrastructure from threats in cyberspace."
Matthew G. Olsen of the Justice Department’s National Security Division said the operation underscores the need to remain vigilant in the face of cybersecurity attacks, particularly ahead of the November 2024 presidential election.
Following the unsealing of the indictment, the department of the U.S. Treasury’s Office of Foreign Assets Control (OFAC) said in a statement Monday that both the U.S. and UK were imposing sanctions on China. The department said it had sanctioned Wuhan Xiaoruizhi Science and Technology Company, Limited (Wuhan XRZ), a Wuhan, China-based MSS front company that served as cover for the malicious cyber operations.
OFAC also said it was designating Zhao Guangzong and Ni Gaobin, two Chinese nationals affiliated with Wuhan XRZ,for their roles in “targeting U.S. entities that operate within U.S. critical infrastructure sectors, directly endangering U.S. national security.”
Story by Kelly Hartog:KNEWZ
