State-backed Chinese threat actors have once again been linked to a high-profile security breach, this time of FBI surveillance systems used for foreign intelligence interception orders.
Google and Mandiant bring news of yet another group that was operating largely below the radar, yet having great success compromising government and telecoms victims throughout the world since at least 2017. In total the gang racked up suspected intrusions in about 70 nations, with 53 confirmed breaches during operations running from 2018 to last year.
The Chinese hackers were likely the only ones exploiting this zero-day vulnerability, but compromised at least a handful of organizations with it dating as far back as the middle of 2024. Dwell time also tends to be in excess of a year as the attackers slowly and quietly move as far as they can through the network and extract secrets.
Multiple government agencieshave come together in a coordinated effort to expel a suspected China-backed espionage group. The campaign was prompted by cyber attacks on critical infrastructure, which reportedly was able to gain “limited” access to some of the nation’s telcos before being rebuffed.
Though the Chinese hackers appear to have compromised Notepad++’s host server and had the ability to push malicious software updates to all of its users, they did not do so for the vast majority. They instead appeared to want to maintain a “low and slow” approach to get at targets of espionage interest.
Agencies are warning of yet another highly advanced, state-sponsored group of Chinese hackers using malware that have been evading detection for years and have an average victim dwell time of 393 days.
Department of Homeland Security (DHS) memo has revealed that Chinese state-sponsored hackers were able to penetrate the Army National Guard network and dwell for most of 2024.
Silk Typhoon has been one of the bigger and more active groups of Chinese hackers since at least 2020, but it looks to be down at least one member.
When Dragos was contracted to implement operational technology security measures for a Massachusetts electric grid company in late 2023, it found that Volt Typhoon had been lurking in their systems since February of that year.
The Belgian government is investigating what looks to be a 2023 attack by Chinese hackers, who breached an external email server used regularly by its federal intelligence service.