Attacks/Breaches

10/19/2015
10:40 AM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

CrowdStrike Spots Chinese APTs Targeting US Firms Post-Pact

CrowdStrike says Chinese threat actors targeted intellectual property at US firms the day after Obama and Xi announced a pact banning cyber espionage for economic gain.

No one expected China to change its cyber espionage ways overnight -- if at all -- in the wake of the historic agreement last month between President Obama and China's president Xi Jinping not to conduct cyberspying attacks for economic gain. So not surprisingly, researchers say they've spotted continued hacking by Chinese groups aiming to steal intellectual property from seven US firms in the technology and pharmaceutical industries.

The pact announced on September 25 by Obama and Xi specifically applies to the theft of trade secrets and stops short of banning traditional espionage via hacking. While the no-hack pact has been met with skepticism, given China's massive cyber espionage machine and strategy of stealing intellectual property for economic gain and competitive advancement, industry experts including Kevin Mandia, founder of Mandiant and president of FireEye, say it's a significant step by the two nations. Mandia -- who says the pact is better than no pact at all -- believes it will ultimately lead the two nations teaming up against cybercrime in the interest of a global economy.

Dmitri Alperovitch, CTO and co-founder of CrowdStrike, blogged today that his firm over the past three weeks had detected and blocked attacks against its customers by Chinese APTs, including the so-called Deep Panda gang.

"The very first intrusion conducted by China-affiliated actors after the joint Xi-Obama announcement at the White House took place the very next day – Saturday September 26th. We detected and stopped the actors, so no exfiltration of customer data actually took place, but the very fact that these attempts occurred highlights the need to remain vigilant despite the newly minted Cyber agreement," he wrote.

"We assess with a high degree of confidence that these intrusions were undertaken by a variety of different Chinese actors, including DEEP PANDA, which CrowdStrike has tracked for many years breaking into national-security targets of strategic importance to China, as well as commercial industries such as Agriculture, Chemical, Financial, Healthcare, Insurance, Legal, Technology and many others," he wrote.

Alperovitch admits a delay between the agreement and any curtailment of this type of hacking by China is "not entirely unexpected." 

He says he is "encouraged" by the US's success in getting China to publicly distinguish between hacking for commercial benefit versus national security-related cyber espionage. "Call me an optimist, but I continue to have hope that meaningful progress can be made to turn the corner and establish norms of behavior for nation-states in cyberspace," he said in his blog post.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
XavierA893
50%
50%
XavierA893,
User Rank: Apprentice
10/30/2015 | 12:57:31 PM
A domestic resource

The Chinese regime has growingly become dependent upon foreign supplies of oil, natural gas and other commodities through secure sea-lanes while the Chinese cyber expertise has become a domestic resource in itself that is as important as the energy supplies for the survival of the regime and its economic development.

Best regards,

Xavier Alfonsi

Analyst in naval and naval aviation affairs and in cyberdefense in Asia-Pacific from original sources in Chinese

Crowdsourced vs. Traditional Pen Testing
Alex Haynes, Chief Information Security Officer, CDL,  3/19/2019
BEC Scammer Pleads Guilty
Dark Reading Staff 3/20/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Well, at least it isn't Mobby Dick!
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
The State of Cyber Security Incident Response
The State of Cyber Security Incident Response
Organizations are responding to new threats with new processes for detecting and mitigating them. Here's a look at how the discipline of incident response is evolving.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-4035
PUBLISHED: 2019-03-22
IBM Content Navigator 3.0CD could allow attackers to direct web traffic to a malicious site. If attackers make a fake IBM Content Navigator site, they can send a link to ICN users to send request to their Edit client directly. Then Edit client will download documents from the fake ICN website. IBM X...
CVE-2019-4052
PUBLISHED: 2019-03-22
IBM API Connect 2018.1 and 2018.4.1.2 apis can be leveraged by unauthenticated users to discover login ids of registered users. IBM X-Force ID: 156544.
CVE-2019-9648
PUBLISHED: 2019-03-22
An issue was discovered in the SFTP Server component in Core FTP 2.0 Build 674. A directory traversal vulnerability exists using the SIZE command along with a \..\..\ substring, allowing an attacker to enumerate file existence based on the returned information.
CVE-2019-9923
PUBLISHED: 2019-03-22
pax_decode_header in sparse.c in GNU Tar before 1.32 had a NULL pointer dereference when parsing certain archives that have malformed extended headers.
CVE-2019-9924
PUBLISHED: 2019-03-22
rbash in Bash before 4.4-beta2 did not prevent the shell user from modifying BASH_CMDS, thus allowing the user to execute any command with the permissions of the shell.