Attacks/Breaches

10/19/2015
10:40 AM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

CrowdStrike Spots Chinese APTs Targeting US Firms Post-Pact

CrowdStrike says Chinese threat actors targeted intellectual property at US firms the day after Obama and Xi announced a pact banning cyber espionage for economic gain.

No one expected China to change its cyber espionage ways overnight -- if at all -- in the wake of the historic agreement last month between President Obama and China's president Xi Jinping not to conduct cyberspying attacks for economic gain. So not surprisingly, researchers say they've spotted continued hacking by Chinese groups aiming to steal intellectual property from seven US firms in the technology and pharmaceutical industries.

The pact announced on September 25 by Obama and Xi specifically applies to the theft of trade secrets and stops short of banning traditional espionage via hacking. While the no-hack pact has been met with skepticism, given China's massive cyber espionage machine and strategy of stealing intellectual property for economic gain and competitive advancement, industry experts including Kevin Mandia, founder of Mandiant and president of FireEye, say it's a significant step by the two nations. Mandia -- who says the pact is better than no pact at all -- believes it will ultimately lead the two nations teaming up against cybercrime in the interest of a global economy.

Dmitri Alperovitch, CTO and co-founder of CrowdStrike, blogged today that his firm over the past three weeks had detected and blocked attacks against its customers by Chinese APTs, including the so-called Deep Panda gang.

"The very first intrusion conducted by China-affiliated actors after the joint Xi-Obama announcement at the White House took place the very next day – Saturday September 26th. We detected and stopped the actors, so no exfiltration of customer data actually took place, but the very fact that these attempts occurred highlights the need to remain vigilant despite the newly minted Cyber agreement," he wrote.

"We assess with a high degree of confidence that these intrusions were undertaken by a variety of different Chinese actors, including DEEP PANDA, which CrowdStrike has tracked for many years breaking into national-security targets of strategic importance to China, as well as commercial industries such as Agriculture, Chemical, Financial, Healthcare, Insurance, Legal, Technology and many others," he wrote.

Alperovitch admits a delay between the agreement and any curtailment of this type of hacking by China is "not entirely unexpected." 

He says he is "encouraged" by the US's success in getting China to publicly distinguish between hacking for commercial benefit versus national security-related cyber espionage. "Call me an optimist, but I continue to have hope that meaningful progress can be made to turn the corner and establish norms of behavior for nation-states in cyberspace," he said in his blog post.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
XavierA893
50%
50%
XavierA893,
User Rank: Apprentice
10/30/2015 | 12:57:31 PM
A domestic resource

The Chinese regime has growingly become dependent upon foreign supplies of oil, natural gas and other commodities through secure sea-lanes while the Chinese cyber expertise has become a domestic resource in itself that is as important as the energy supplies for the survival of the regime and its economic development.

Best regards,

Xavier Alfonsi

Analyst in naval and naval aviation affairs and in cyberdefense in Asia-Pacific from original sources in Chinese

Government Shutdown Brings Certificate Lapse Woes
Curtis Franklin Jr., Senior Editor at Dark Reading,  1/11/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
The Year in Security 2018
This Dark Reading Tech Digest explores the biggest news stories of 2018 that shaped the cybersecurity landscape.
Flash Poll
How Enterprises Are Attacking the Cybersecurity Problem
How Enterprises Are Attacking the Cybersecurity Problem
Data breach fears and the need to comply with regulations such as GDPR are two major drivers increased spending on security products and technologies. But other factors are contributing to the trend as well. Find out more about how enterprises are attacking the cybersecurity problem by reading our report today.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-20735
PUBLISHED: 2019-01-17
** DISPUTED ** An issue was discovered in BMC PATROL Agent through 11.3.01. It was found that the PatrolCli application can allow for lateral movement and escalation of privilege inside a Windows Active Directory environment. It was found that by default the PatrolCli / PATROL Agent application only...
CVE-2019-0624
PUBLISHED: 2019-01-17
A spoofing vulnerability exists when a Skype for Business 2015 server does not properly sanitize a specially crafted request, aka "Skype for Business 2015 Spoofing Vulnerability." This affects Skype.
CVE-2019-0646
PUBLISHED: 2019-01-17
A Cross-site Scripting (XSS) vulnerability exists when Team Foundation Server does not properly sanitize user provided input, aka "Team Foundation Server Cross-site Scripting Vulnerability." This affects Team.
CVE-2019-0647
PUBLISHED: 2019-01-17
An information disclosure vulnerability exists when Team Foundation Server does not properly handle variables marked as secret, aka "Team Foundation Server Information Disclosure Vulnerability." This affects Team.
CVE-2018-20727
PUBLISHED: 2019-01-17
Multiple command injection vulnerabilities in NeDi before 1.7Cp3 allow authenticated users to execute code on the server side via the flt parameter to Nodes-Traffic.php, the dv parameter to Devices-Graph.php, or the tit parameter to drawmap.php.