American tech giant Microsoft has blamed the Chinese government for the cyber attacks. These Chinese hackers have targeted important US government functionaries and servers.

Microsoft: Chinese government accountable for cyber attacks on 'exchange server'

Israeli researchers said on Monday that&nbsp;Chinese spies used code first developed by the US&nbsp;National Security Agency to support their hacking operations, another indication of how malicious software developed by governments can boomerang against their creators.

Tel Aviv-based Check Point Software Technologies issued a report noting that some features in a piece of China-linked malware it dubs "Jian" were so similar they could only have been stolen from some of the National Security Agency break-in tools leaked to the internet in 2017.

Yaniv Balmas, Checkpoint's head of research, called Jian "kind of a copycat, a Chinese replica."

Also read-<a href="https://www.wionews.com/world/chinese-hackers-targeting-biden-and-trump-are-faking-mcafee-software-google-336251">Chinese hackers targeting Biden and Trump are faking McAfee software: Google</a>

The find comes as some experts argue that American spies should devote more energy to fixing the flaws they find in software instead of developing and deploying malicious software to exploit it.

Lockheed Martin Corp, which is credited as having identified the vulnerability exploited by Jian in 2017, discovered it on the network of an unidentified third party.

<div class="videoWrapper trancodeVideo"><iframe allowfullscreen="" autoplay="1" class="includeVideo" frameborder="0" height="350" src="https://www.wionews.com/videos/gravitas-chinese-hackers-the-next-big-security-threat-315244/embed" style="width:100%;max-width:560px;" width="560"></iframe></div>

In a statement, Lockheed said it "routinely evaluates third-party software and technologies to identify vulnerabilities."

Countries around the world develop malware that breaks into their rivals' devices by taking advantage of flaws in the software that runs them. Every time spies discover a new flaw they must decide whether to quietly exploit it or fix the issue to thwart rivals and rogues.

That dilemma came to public attention between 2016 and 2017, when a mysterious group calling itself the "Shadow Brokers" published some of the NSA's most dangerous code to the internet, allowing cybercriminals and rival nations to add American-made digital break-in tools to their own arsenals.

How the Jian malware analyzed by Checkpoint was used is not clear. In an advisory published in 2017, Microsoft Corp suggested it was linked to a Chinese entity it dubs "Zirconium," which last year was accused of targeting US&nbsp;election-related organizations and individuals, including people associated with President Joe Biden's campaign.

Checkpoint says Jian appears to have been crafted in 2014, at least two years before the Shadow Brokers made their public debut. That, in conjunction with research published in 2019 by Broadcom Inc-owned cybersecurity firm Symantec about a similar incident, suggests the NSA has repeatedly lost control of its own malware over the years.

Checkpoint's research is thorough and "looks legit," said Costin Raiu, a researcher with Moscow-based antivirus firm Kaspersky Lab, which has helped dissect some of the NSA's malware.

Balmas said a possible takeaway from his company's report was for spymasters weighing whether to keep software flaws secret to think twice about using a vulnerability for their own ends.

"Maybe it's more important to patch this thing and save the world," Balmas said. "It might be used against you."

Israeli researchers said on Monday that Chinese spies used code first developed by the US National Security Agency to support their hacking operations, another indication of how malicious software developed by governments can boomerang against their creators.

Israeli researchers said on Monday that Chinese spies used code first developed by the US National Security Agency to support their hacking operations, another indication of how malicious software developed by governments can boomerang against their creators. Tel Aviv-based Check Point Software Technologies issued a report noting that some features in a piece of China-linked malware it dubs "Jian" were so similar they could only have been stolen from some of the National Security Agency break-in tools leaked to the internet in 2017. Yaniv Balmas, Checkpoint's head of research, called Jian "kind of a copycat, a Chinese replica." Also read-Chinese hackers targeting Biden and Trump are faking McAfee software: Google The find comes as some experts argue that American spies should devote more energy to fixing the flaws they find in software instead of developing and deploying malicious software to exploit it. Lockheed Martin Corp, which is credited as having identified the vulnerability exploited by Jian in 2017, discovered it on the network of an unidentified third party. In a statement, Lockheed said it "routinely evaluates third-party software and technologies to identify vulnerabilities." Countries around the world develop malware that breaks into their rivals' devices by taking advantage of flaws in the software that runs them. Every time spies discover a new flaw they must decide whether to quietly exploit it or fix the issue to thwart rivals and rogues. That dilemma came to public attention between 2016 and 2017, when a mysterious group calling itself the "Shadow Brokers" published some of the NSA's most dangerous code to the internet, allowing cybercriminals and rival nations to add American-made digital break-in tools to their own arsenals. How the Jian malware analyzed by Checkpoint was used is not clear. In an advisory published in 2017, Microsoft Corp suggested it was linked to a Chinese entity it dubs "Zirconium," which last year was accused of targeting US election-related organizations and individuals, including people associated with President Joe Biden's campaign. Checkpoint says Jian appears to have been crafted in 2014, at least two years before the Shadow Brokers made their public debut. That, in conjunction with research published in 2019 by Broadcom Inc-owned cybersecurity firm Symantec about a similar incident, suggests the NSA has repeatedly lost control of its own malware over the years. Checkpoint's research is thorough and "looks legit," said Costin Raiu, a researcher with Moscow-based antivirus firm Kaspersky Lab, which has helped dissect some of the NSA's malware. Balmas said a possible takeaway from his company's report was for spymasters weighing whether to keep software flaws secret to think twice about using a vulnerability for their own ends. "Maybe it's more important to patch this thing and save the world," Balmas said. "It might be used against you."

Israeli researchers reveal China copied spyware code from America's NSA

A hacking group from China is suspected of attacking the airline industry over the last few years to obtain data of passengers. Reportedly, this was done to track the movement of people of interest to China. Zdnet reported that the hackers have been attacking the data under the name of Chimera.

Additionally, the group operates for the Chinese state. Initially, the activities of the group were reported in a Black Hat presentation from CyCraft in 2020.

In its initial findings, they found that a series of coordinated attacks took place against Taiwan's superconductor industry.

Last week, NCC Group published a new report claiming that intrusions into its data are broader than previously thought. Its subsidiary Fox-IT also reported the same. Even in this case, the airline industry was targetted.

"NCC Group and Fox-IT observed this threat actor during various incident response engagements performed between October 2019 until April 2020," Zdnet quotes the companies as saying.

Also read:&nbsp;<a href="http://13.235.153.162/world/us-intel-agencies-say-russia-likely-behind-hacking-of-govt-agencies-354752" hreflang="en">US intel agencies say Russia likely behind hacking of govt agencies</a> 
 
Both the companies said that these attacks were targetting airline and semiconductor companies across different parts of the world, and not just in Asia. 
 
In many cases, hackers hid inside networks for over three years before they were discovered.

Reportedly, the attack on semiconductor industry aimed to steal intellectual property, while in the case of the airline industry, the goal was different.

Also read:&nbsp;<a href="http://13.235.153.162/world/european-medicines-agency-hacking-pfizer-biontech-confirm-vaccine-documents-unlawfully-accessed-348845" hreflang="en">European Medicines Agency hacking: Pfizer-BioNTech confirm vaccine documents 'unlawfully accessed'</a>

The companies claimed that the hackers were targeting victims to obtain Passenger Name Records or what is commonly known as PNR. 
 
The report by NCC and Fox-IT mentions how Chimera operates, saying that it begins by collecting login credentials that became part of the public domain after other companies suffered data breaches. 
 
Once the data was accessed and collected, the information was uploaded to OneDrive, Dropbox, or Google Drive, for traffic flowing into these services is barely inspected.

A hacking group from China is suspected of attacking the airline industry over the last few years to obtain data of passengers. Reportedly, this was done to track the movement of people of interest to China.

A hacking group from China is suspected of attacking the airline industry over the last few years to obtain data of passengers. Reportedly, this was done to track the movement of people of interest to China. Zdnet reported that the hackers have been attacking the data under the name of Chimera. Additionally, the group operates for the Chinese state. Initially, the activities of the group were reported in a Black Hat presentation from CyCraft in 2020. In its initial findings, they found that a series of coordinated attacks took place against Taiwan's superconductor industry. Last week, NCC Group published a new report claiming that intrusions into its data are broader than previously thought. Its subsidiary Fox-IT also reported the same. Even in this case, the airline industry was targetted. "NCC Group and Fox-IT observed this threat actor during various incident response engagements performed between October 2019 until April 2020," Zdnet quotes the companies as saying. Also read: US intel agencies say Russia likely behind hacking of govt agencies Both the companies said that these attacks were targetting airline and semiconductor companies across different parts of the world, and not just in Asia. In many cases, hackers hid inside networks for over three years before they were discovered. Reportedly, the attack on semiconductor industry aimed to steal intellectual property, while in the case of the airline industry, the goal was different. Also read: European Medicines Agency hacking: Pfizer-BioNTech confirm vaccine documents 'unlawfully accessed' The companies claimed that the hackers were targeting victims to obtain Passenger Name Records or what is commonly known as PNR. The report by NCC and Fox-IT mentions how Chimera operates, saying that it begins by collecting login credentials that became part of the public domain after other companies suffered data breaches. Once the data was accessed and collected, the information was uploaded to OneDrive, Dropbox, or Google Drive, for traffic flowing into these services is barely inspected.

A Chinese hacker group is stealing global airline passenger data

Months before the US election, the Democratic President elect Joe Biden's election campaign was targeted by a group of Chinese hackers in&nbsp;a phishing attack.

A Google report by the Threat Analysis Group (TAG) has now claimed that the attack coordinated by a group of Chinese hackers are faking&nbsp;antivirus software McAfee to target the suspects.

This group of hackers appears to be the same group that had earlier targeted the US President Donald Trump in an&nbsp;unsuccessful attack.

<a href="https://www.wionews.com/technology/twitter-changes-policy-on-hacking-after-biden-censorship-expose-fiasco-335713">Also read|&nbsp;Twitter changes policy on hacking after Biden censorship expose fiasco</a>

As per the report, the hackers&nbsp;from the Iranian attacker group (APT35) and the Chinese attacker group (APT31) send a prompt asking victims to install the antivirus software and then let the virus silently creep into their systems.

Explaining how the group attacks the victims, Google's report stated, "The targets would be prompted to install a legitimate version of McAfee anti-virus software from GitHub, while malware was simultaneously silently installed to the system."

The tech giant claims that there has been an increase in such attacks in the pandemic, especially with the US elections being a few weeks away.

However, Google also assured that as soon as these attacks are identified, the victim is informed on a priority basis. "When we detect that a user is the target of a government-backed attack, we send them a prominent warning. In these cases, we also shared our findings with the campaigns and the Federal Bureau of Investigation. This targeting is consistent with what others have subsequently reported."

<a href="https://www.wionews.com/world/russia-behind-cyberattack-on-parliament-norway-335097">Also read:&nbsp;Russia behind cyberattack on parliament: Norway</a>

The report also cautioned users to rethink their YouTube activity, explaining that their&nbsp;Trust and Safety teams terminated more than 3,000 YouTube channels. TAG claimed that they have tracked a large spam network — linked to China — that runs an influence operation, especially on YouTube, that targets existing accounts by&nbsp;"posting spammy content in Mandarin such as videos of animals, music, food, plants, sports, and games."

"Such videos frequently feature clumsy translations and computer-generated voices. Researchers at Graphika and FireEye have detailed how this network behaves—including its shift from posting content in Mandarin about issues related to Hong Kong and China’s response to COVID-19, to including a small subset of content in English and Mandarin about current events in the U.S. (such as protests around racial justice, the wildfires on the West Coast, and the U.S. response to COVID-19)," the report continued.

Months before the US election, the Democratic President elect Joe Biden's election campaign was targeted by a group of Chinese hackers in a phishing attack. A Google report by the Threat Analysis Group (TAG) has now claimed that the attack coordinated by a group of Chinese hackers are faking antivirus software McAfee to target the suspects.

Months before the US election, the Democratic President elect Joe Biden's election campaign was targeted by a group of Chinese hackers in a phishing attack. A Google report by the Threat Analysis Group (TAG) has now claimed that the attack coordinated by a group of Chinese hackers are faking antivirus software McAfee to target the suspects. This group of hackers appears to be the same group that had earlier targeted the US President Donald Trump in an unsuccessful attack. Also read| Twitter changes policy on hacking after Biden censorship expose fiasco As per the report, the hackers from the Iranian attacker group (APT35) and the Chinese attacker group (APT31) send a prompt asking victims to install the antivirus software and then let the virus silently creep into their systems. Explaining how the group attacks the victims, Google's report stated, "The targets would be prompted to install a legitimate version of McAfee anti-virus software from GitHub, while malware was simultaneously silently installed to the system." The tech giant claims that there has been an increase in such attacks in the pandemic, especially with the US elections being a few weeks away. However, Google also assured that as soon as these attacks are identified, the victim is informed on a priority basis. "When we detect that a user is the target of a government-backed attack, we send them a prominent warning. In these cases, we also shared our findings with the campaigns and the Federal Bureau of Investigation. This targeting is consistent with what others have subsequently reported." Also read: Russia behind cyberattack on parliament: Norway The report also cautioned users to rethink their YouTube activity, explaining that their Trust and Safety teams terminated more than 3,000 YouTube channels. TAG claimed that they have tracked a large spam network — linked to China — that runs an influence operation, especially on YouTube, that targets existing accounts by "posting spammy content in Mandarin such as videos of animals, music, food, plants, sports, and games." "Such videos frequently feature clumsy translations and computer-generated voices. Researchers at Graphika and FireEye have detailed how this network behaves—including its shift from posting content in Mandarin about issues related to Hong Kong and China’s response to COVID-19, to including a small subset of content in English and Mandarin about current events in the U.S. (such as protests around racial justice, the wildfires on the West Coast, and the U.S. response to COVID-19)," the report continued.

Chinese hackers targeting Biden and Trump are faking McAfee software: Google

The US Justice Department has revealed that 5 Chinese hackers have been charged in a multi-nation spying and targeting government networks in India.

5 Chinese nationals charged for hacking Indian govt sites

The US Justice Department has revealed that Chinese hackers charged in a multi-nation spying and targetted government networks in India. Watch report.

'Hackers targetted Indian government websites' | US Justice Department reveals

The US Justice Department has said the five Chinese hackers who were charged targeted Indian government's networks and "compromised foreign government computer networks".

<a href="https://www.wionews.com/technology/chinese-hacker-group-apt41-dupe-companies-in-malaysia-and-china-328339">Also Read: Chinese hacker group, APT41, dupe companies in Malaysia and China</a>

Deputy US Attorney General Jeffrey Rosen has charged five Chinese nationals with computer hacking and charged two Malaysians for helping them.

Justice Department statement said the Malaysian nationals were arrested but the Chinese nationals were still at large.

"In about 2019, the conspirators compromised government of lndia websites, as well as virtual private networks and database servers supporting the government of India. The conspirators used VPS PROVIDER servers to connect to an Open VPN network owned by the government of India," the indictment said.

The conspirators had installed "Cobalt strike" malware on Indian government-protected computers, it added.

"In one notable instance, the defendants conducted a ransomware attack on the network of a non-profit organization dedicated to combating global poverty," it said.

The indictment against Zhang and Tan charged the defendants with "two counts" of conspiracy to commit computer fraud which carries a maximum sentence of five years in prison.

The US government alleged that the hackers targeted "over 100 victim companies in the United States and abroad, including software development companies, computer hardware manufacturers, telecommunications providers, social media companies, video game companies, non-profit organizations, universities, think tanks, and foreign governments, as well as pro-democracy politicians and activists in Hong Kong."

"The intrusions, which security researchers have tracked using the threat labels “APT41,” “Barium,” “Winnti,” “Wicked Panda,” and “Wicked Spider,” it said.

“The scope and sophistication of the crimes in these unsealed indictments is unprecedented. The alleged criminal scheme used actors in China and Malaysia to illegally hack, intrude and steal information from victims worldwide,” Michael R. Sherwin, acting US attorney for the District of Columbia, said.

The US Justice Department has said the five Chinese hackers who were charged targeted Indian government's networks and "compromised foreign government computer networks".

The US Justice Department has said the five Chinese hackers who were charged targeted Indian government's networks and "compromised foreign government computer networks". Also Read: Chinese hacker group, APT41, dupe companies in Malaysia and China Deputy US Attorney General Jeffrey Rosen has charged five Chinese nationals with computer hacking and charged two Malaysians for helping them. Justice Department statement said the Malaysian nationals were arrested but the Chinese nationals were still at large. "In about 2019, the conspirators compromised government of lndia websites, as well as virtual private networks and database servers supporting the government of India. The conspirators used VPS PROVIDER servers to connect to an Open VPN network owned by the government of India," the indictment said. The conspirators had installed "Cobalt strike" malware on Indian government-protected computers, it added. "In one notable instance, the defendants conducted a ransomware attack on the network of a non-profit organization dedicated to combating global poverty," it said. The indictment against Zhang and Tan charged the defendants with "two counts" of conspiracy to commit computer fraud which carries a maximum sentence of five years in prison. The US government alleged that the hackers targeted "over 100 victim companies in the United States and abroad, including software development companies, computer hardware manufacturers, telecommunications providers, social media companies, video game companies, non-profit organizations, universities, think tanks, and foreign governments, as well as pro-democracy politicians and activists in Hong Kong." "The intrusions, which security researchers have tracked using the threat labels “APT41,” “Barium,” “Winnti,” “Wicked Panda,” and “Wicked Spider,” it said. “The scope and sophistication of the crimes in these unsealed indictments is unprecedented. The alleged criminal scheme used actors in China and Malaysia to illegally hack, intrude and steal information from victims worldwide,” Michael R. Sherwin, acting US attorney for the District of Columbia, said.

Chinese hackers compromised Indian government websites: US Justice Department

A Chinese hacker group called&nbsp;APT41 has been&nbsp;charged by the US Justice Department after the Federal Bureau of Investigation (FBI) and Microsoft caught two of the hackers in a combined effort.&nbsp;

APT41 is a group of seven hackers, out of which five of them are Chinese nationals and are expert hackers. Majority of the group members have been employees of&nbsp;Chengdu 404 Network Technology — a company that provides legal hacking services to the company to help&nbsp;detect vulnerabilities in clients' computer networks. The other company involved in the case is&nbsp;SEA Gamer Mall, a Malaysia-based firm that sells video game currency, power-ups and other in-game items.

They trapped various groups — from gaming companies to non-profit organisations — by several sophisticated and basic phishing methods. While some companies got duped through phishing emails, rest gave permission to the group to modify their codes, which provided them free and unlimited access to clients' computers and internal data.

The group has been alleged of hacking hundreds of computers of various companies around the world. The hackers accessed identities, personal information and used the hacked information to ask for ransom and commit&nbsp;cryptocurrency/bitcoin frauds. They also hacked into systems of gaming companies through which they used the data to sell game items back to the customers and dupe them of money.

They have&nbsp;also been alleged of compromising government&nbsp;data in Vietnam and India.&nbsp;

Whether or not the group was working for the Chinese government is not yet clear. The court has alleged that the hackers collected information regarding pro-democracy activists of Hong Kong and&nbsp;a Buddhist monk from Tibet. One of the hackers,&nbsp;Jiang Lizhi, has a history of working with&nbsp;China's Ministry of State Security.

However, none of these allegations have successfully proved a connection between the hacker group and the Chinese government. More investigation is being carried out for this.

Out of seven, two members have been caught. However, these two were businessmen in Malaysia, and the hackers are still at large. The two businessmen were caught in a&nbsp;sweeping operation by the FBI and private companies including Microsoft to block the hackers from using their online accounts.

The US is currently seeking permission to extradite the hacker groups, which is seemingly difficult as none of the members have lived in the US, but have committed frauds in the country.

A Chinese hacker group called APT41 has been charged by the US Justice Department after the Federal Bureau of Investigation (FBI) and Microsoft caught two of the hackers in a combined effort.

A Chinese hacker group called APT41 has been charged by the US Justice Department after the Federal Bureau of Investigation (FBI) and Microsoft caught two of the hackers in a combined effort. APT41 is a group of seven hackers, out of which five of them are Chinese nationals and are expert hackers. Majority of the group members have been employees of Chengdu 404 Network Technology — a company that provides legal hacking services to the company to help detect vulnerabilities in clients' computer networks. The other company involved in the case is SEA Gamer Mall, a Malaysia-based firm that sells video game currency, power-ups and other in-game items. They trapped various groups — from gaming companies to non-profit organisations — by several sophisticated and basic phishing methods. While some companies got duped through phishing emails, rest gave permission to the group to modify their codes, which provided them free and unlimited access to clients' computers and internal data. The group has been alleged of hacking hundreds of computers of various companies around the world. The hackers accessed identities, personal information and used the hacked information to ask for ransom and commit cryptocurrency/bitcoin frauds. They also hacked into systems of gaming companies through which they used the data to sell game items back to the customers and dupe them of money. They have also been alleged of compromising government data in Vietnam and India. Whether or not the group was working for the Chinese government is not yet clear. The court has alleged that the hackers collected information regarding pro-democracy activists of Hong Kong and a Buddhist monk from Tibet. One of the hackers, Jiang Lizhi, has a history of working with China's Ministry of State Security. However, none of these allegations have successfully proved a connection between the hacker group and the Chinese government. More investigation is being carried out for this. Out of seven, two members have been caught. However, these two were businessmen in Malaysia, and the hackers are still at large. The two businessmen were caught in a sweeping operation by the FBI and private companies including Microsoft to block the hackers from using their online accounts. The US is currently seeking permission to extradite the hacker groups, which is seemingly difficult as none of the members have lived in the US, but have committed frauds in the country.

Chinese hacker group, APT41, dupe companies in Malaysia and China

The US government on Wednesday announced charges over global hacking against five Chinese nationals and two Malaysians.

"First and foremost is that we have unsealed three indictments that collectively charge five Chinese nationals with computer hacking and charge two Malaysian nationals for helping some of those hackers target victims and sell the fruits of their hacking," US deputy attorney general, Jeffrey Rosen, said.

The five Chinese hackers were charged with hacking over a hundred companies in the United States and abroad including foreign governments and pro-democracy activists in Hong Kong.

"First, as the core of Apt 41's computer hacking, the Chinese defendants targeted well over 100 victims worldwide in a variety of industries and sectors that are sadly part of the standard target list for Chinese hackers," Rosen said.

The US Justice Department said that two Malaysian businessmen Ling Yang Ching and Wong Ong Hua were charged with conspiring with two of the Chinese hackers to profit from computer hacking in various countries including the United States, Japan, Singapore, South Korea and France.

"Some of these criminal actors believed their association with the PRC provided them free license to hack and steal across the globe," federal prosecutor Michael Sherwin said in a statement.

The whereabouts of the five Chinese remain unknown, however, the two Malaysians were arrested in Malaysia on Monday and the United States is seeking their extradition.

The US government on Wednesday announced charges over global hacking against five Chinese nationals and two Malaysians. "First and foremost is that we have unsealed three indictments that collectively charge five Chinese nationals with computer hacking and charge two Malaysian nationals for helping some of those hackers target victims and sell the fruits of their hacking," US deputy attorney general, Jeffrey Rosen, said.

The US government on Wednesday announced charges over global hacking against five Chinese nationals and two Malaysians. "First and foremost is that we have unsealed three indictments that collectively charge five Chinese nationals with computer hacking and charge two Malaysian nationals for helping some of those hackers target victims and sell the fruits of their hacking," US deputy attorney general, Jeffrey Rosen, said. The five Chinese hackers were charged with hacking over a hundred companies in the United States and abroad including foreign governments and pro-democracy activists in Hong Kong. "First, as the core of Apt 41's computer hacking, the Chinese defendants targeted well over 100 victims worldwide in a variety of industries and sectors that are sadly part of the standard target list for Chinese hackers," Rosen said. The US Justice Department said that two Malaysian businessmen Ling Yang Ching and Wong Ong Hua were charged with conspiring with two of the Chinese hackers to profit from computer hacking in various countries including the United States, Japan, Singapore, South Korea and France. "Some of these criminal actors believed their association with the PRC provided them free license to hack and steal across the globe," federal prosecutor Michael Sherwin said in a statement. The whereabouts of the five Chinese remain unknown, however, the two Malaysians were arrested in Malaysia on Monday and the United States is seeking their extradition.

US announces charges against Chinese, Malaysians involved in worldwide hacking racket

Amid China's recent feuds with multiple nations including the ongoing border standoff with India, a media report has claimed that&nbsp;a database compiled by a Chinese tech company&nbsp;has at least 1,400 entries covering the Indian economy.

Overseas Key Individual DataBase (OKIDB), built by Zhenhua Data, reportedly has&nbsp;links to the country’s military and intelligence networks.&nbsp;People's Liberation Army and the Chinese Communist Party are&nbsp;some of its main clients.

Also read:&nbsp;<a href="https://www.wionews.com/india-news/china-snooping-on-top-indian-politicians-defence-chiefs-and-news-media-editors-reports-327391" hreflang="en">China snooping on top Indian politicians, defence chiefs and news media editors: Reports</a>

Chinese online spies are aiming at the venture capitalists, angel investors, founders and chief technology officers of India’s new online ventures including payment apps, technology startups and foreigner investors based in country.

<div class="videoWrapper trancodeVideo"><iframe allowfullscreen="" autoplay="1" class="includeVideo" frameborder="0" height="350" src="https://www.wionews.com/videos/gravitas-china-is-snooping-on-wion-327581/embed" style="width:100%;max-width:560px;" width="560"></iframe></div>

The prominent personalities that are being tracked include:&nbsp;T K Kurien, the Chief Investment Officer at the Premji Invest, a venture capital company set up by Azim Premji,&nbsp;Anish Shah, Group CFO, Mahindra Group,&nbsp;PK X Thomas, CTO, Reliance Brands,&nbsp;Brian Bade, Chief Executive, Reliance Retail; and Vineet Sekhsaria, Country Head, Morgan Stanley, Real Estate Investing.

Flipkart co-founder&nbsp;Binny Bansal,&nbsp;Zomato founder and CEO Deepinder Goyal; Swiggy co-founder and CEO Nandan Reddy&nbsp;Nykaa co-founder and CEO Falguni Nayar; Uber India’s head of driver operations Pavan Vaish, and PayU business head Nameet Potnis are also part of&nbsp;the list.&nbsp;

The report&nbsp;comes when Chinese investment in Indian startups surged by over 10 times from $ 381 million in 2016 to $4.6 billion in 2019.

Also read:&nbsp;<a href="https://www.wionews.com/india-news/rattled-by-zee-groups-coverage-china-puts-spies-on-editor-in-chief-sudhir-chaudhary-report-327401" hreflang="en">Rattled by Zee group’s coverage, China puts spies on Editor-in-Chief Sudhir Chaudhary: Report</a>

Zhenhua Data Information Technology Co. Limited, which is based in Shenzen, has been tasked with monitoring over 10,000 prominent citizens including top brass of the India’s Army, Judiciary, scientific establishments and news media, a report by The Indian Express has said.

According to the report the top brass of the India’s Army, Judiciary, scientific establishments and news media are on the target list.

OKIDB &nbsp;is monitoring a wide range of influential Indian individuals. OKIDB tracks targets without leaving any explicit footprint.

Overall, approximately 2.4 million people are included in the database, assembled mostly based on public open-source data such as social media profiles, analysts said.

The database report demonstrates that the depth and the breadth of Chinese surveillance could not be underestimated.

Amid China's recent feuds with multiple nations including the ongoing border standoff with India, a media report has claimed that a database compiled by a Chinese tech company has at least 1,400 entries covering the Indian economy.

Amid China's recent feuds with multiple nations including the ongoing border standoff with India, a media report has claimed that a database compiled by a Chinese tech company has at least 1,400 entries covering the Indian economy. Overseas Key Individual DataBase (OKIDB), built by Zhenhua Data, reportedly has links to the country’s military and intelligence networks. People's Liberation Army and the Chinese Communist Party are some of its main clients. Also read: China snooping on top Indian politicians, defence chiefs and news media editors: Reports Chinese online spies are aiming at the venture capitalists, angel investors, founders and chief technology officers of India’s new online ventures including payment apps, technology startups and foreigner investors based in country. The prominent personalities that are being tracked include: T K Kurien, the Chief Investment Officer at the Premji Invest, a venture capital company set up by Azim Premji, Anish Shah, Group CFO, Mahindra Group, PK X Thomas, CTO, Reliance Brands, Brian Bade, Chief Executive, Reliance Retail; and Vineet Sekhsaria, Country Head, Morgan Stanley, Real Estate Investing. Flipkart co-founder Binny Bansal, Zomato founder and CEO Deepinder Goyal; Swiggy co-founder and CEO Nandan Reddy Nykaa co-founder and CEO Falguni Nayar; Uber India’s head of driver operations Pavan Vaish, and PayU business head Nameet Potnis are also part of the list. The report comes when Chinese investment in Indian startups surged by over 10 times from $ 381 million in 2016 to $4.6 billion in 2019. Also read: Rattled by Zee group’s coverage, China puts spies on Editor-in-Chief Sudhir Chaudhary: Report Zhenhua Data Information Technology Co. Limited, which is based in Shenzen, has been tasked with monitoring over 10,000 prominent citizens including top brass of the India’s Army, Judiciary, scientific establishments and news media, a report by The Indian Express has said. According to the report the top brass of the India’s Army, Judiciary, scientific establishments and news media are on the target list. OKIDB is monitoring a wide range of influential Indian individuals. OKIDB tracks targets without leaving any explicit footprint. Overall, approximately 2.4 million people are included in the database, assembled mostly based on public open-source data such as social media profiles, analysts said. The database report demonstrates that the depth and the breadth of Chinese surveillance could not be underestimated.

China targets India's new economy: Snooping on online ventures and tech startups

China is being seen as a growing threat by traditional powers and not just the United States. Now even the European Union has decided to act Chinese intelligence agencies and its assets. Watch report.

WION Dispatch: EU sanctions Chinese hackers, Sanctions include travel ban and asset freeze

The European Union imposed its first ever sanctions against alleged cyber attackers on Thursday, targeting Russian and Chinese individuals and a specialist unit of Moscow's GRU military intelligence agency.

The member states said measures would be taken against six individuals and three entities involved in various actions, including the attempt to hack into the Organisation for the Prohibition of Chemical Weapons.

Thousands of Russian and Chinese-linked social media accounts have launched a coordinated effort to spread alarm about the new coronavirus, disrupting global efforts to fight the epidemic according to&nbsp;Fernando Arias,&nbsp;the head of the Organization for the Prohibition of Chemical Weapons (OPCW).

The accounts, run by humans, not bots, post at similar times in English, Spanish, Italian, German and French and can be linked back to Russian proxies, or carry similar messages to Chinese-backed outlets like Xinhua and&nbsp;Russian-backed outlets such as RT and Sputnik, he added.

The disinformation campaign was identified by US monitors in mid-January after Chinese officials announced a third death from the new coronavirus in Wuhan, the epicentre of the outbreak.

The European Union imposed its first ever sanctions against alleged cyber attackers on Thursday, targeting Russian and Chinese individuals and a specialist unit of Moscow's GRU military intelligence agency.

The European Union imposed its first ever sanctions against alleged cyber attackers on Thursday, targeting Russian and Chinese individuals and a specialist unit of Moscow's GRU military intelligence agency. The member states said measures would be taken against six individuals and three entities involved in various actions, including the attempt to hack into the Organisation for the Prohibition of Chemical Weapons. Thousands of Russian and Chinese-linked social media accounts have launched a coordinated effort to spread alarm about the new coronavirus, disrupting global efforts to fight the epidemic according to Fernando Arias, the head of the Organization for the Prohibition of Chemical Weapons (OPCW). The accounts, run by humans, not bots, post at similar times in English, Spanish, Italian, German and French and can be linked back to Russian proxies, or carry similar messages to Chinese-backed outlets like Xinhua and Russian-backed outlets such as RT and Sputnik, he added. The disinformation campaign was identified by US monitors in mid-January after Chinese officials announced a third death from the new coronavirus in Wuhan, the epicentre of the outbreak.

EU slaps sanctions on Russian and Chinese 'cyber attackers'

The United States has revealed that in the last 10 years, two hackers targeted 10 countries with support from Chinese spies. Recently, the hackers tried to steal information about Coronavirus vaccine from two companies.

Gravitas: Chinese hackers: The next big security threat

State-backed hackers from China and Iran have targeted staffers working on the US&nbsp;presidential campaign of Democratic candidate Joe Biden and US President Donald respectively according to&nbsp;a senior Google security official.

The announcement, made on Twitter by the head of Google's Threat Analysis Group, Shane Huntley, is the latest indication of the digital spying routinely aimed at top politicians of all stripes.

<div class="ui-state-default" contenteditable="false">
<div class="twitter-block" draggable="false">
<blockquote class="twitter-tweet">
Recently TAG saw China APT group targeting Biden campaign staff &amp; Iran APT targeting Trump campaign staff with phishing. No sign of compromise. We sent users our govt attack warning and we referred to fed law enforcement. <a href="https://t.co/ozlRL4SwhG">https://t.co/ozlRL4SwhG</a>
— Shane Huntley (@ShaneHuntley) <a href="https://twitter.com/ShaneHuntley/status/1268589219842109440?ref_src=twsrc%5Etfw">June 4, 2020</a></blockquote>
<script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script></div>
<a class="close-mark close-div" href="#" id="jqclosemark">×</a></div>

Huntley said there was "no sign of compromise" of either campaign.

Also read:&nbsp;<a href="https://www.wionews.com/world/donald-trumps-approval-rating-dips-currently-trails-behind-biden-polls-298359">Donald Trump's approval rating dips, currently trails behind Biden: Polls</a>

Iranian attempts to break into Trump campaign officials' emails have been documented before. Last year, Microsoft Corp announced that a group often nicknamed Charming Kitten had tried to break into email accounts belonging to an unnamed US&nbsp;presidential campaign that sources identified as Trump's.

Earlier this year, the threat intelligence company Area1 said that Russian hackers had targeted companies tied to a Ukrainian gas firm where Biden's son once served on the board.

Google declined to offer details beyond Huntley's tweets, but the unusually public attribution is a sign of how sensitive Americans have become to digital espionage efforts aimed at political campaigns.

State-backed hackers from China and Iran have targeted staffers working on the US presidential campaign of Democratic candidate Joe Biden and US President Donald respectively according to a senior Google security official.

State-backed hackers from China and Iran have targeted staffers working on the US presidential campaign of Democratic candidate Joe Biden and US President Donald respectively according to a senior Google security official. The announcement, made on Twitter by the head of Google's Threat Analysis Group, Shane Huntley, is the latest indication of the digital spying routinely aimed at top politicians of all stripes. Recently TAG saw China APT group targeting Biden campaign staff & Iran APT targeting Trump campaign staff with phishing. No sign of compromise. We sent users our govt attack warning and we referred to fed law enforcement. https://t.co/ozlRL4SwhG — Shane Huntley (@ShaneHuntley) June 4, 2020 × Huntley said there was "no sign of compromise" of either campaign. Also read: Donald Trump's approval rating dips, currently trails behind Biden: Polls Iranian attempts to break into Trump campaign officials' emails have been documented before. Last year, Microsoft Corp announced that a group often nicknamed Charming Kitten had tried to break into email accounts belonging to an unnamed US presidential campaign that sources identified as Trump's. Earlier this year, the threat intelligence company Area1 said that Russian hackers had targeted companies tied to a Ukrainian gas firm where Biden's son once served on the board. Google declined to offer details beyond Huntley's tweets, but the unusually public attribution is a sign of how sensitive Americans have become to digital espionage efforts aimed at political campaigns.

Biden and Trump's campaigns targeted by Chinese and Iranian hackers: Google

Chinese hackers who used a previously unknown iPhone security flaw to target ethnic minority Uighurs also went after Tibetans in exile, according to a report published on Tuesday.

It was the first detected use of malicious software against exiled Tibetans that required only a single click on a mobile device to work, said Citizen Lab, a Canada-based academic research group.

Citing the technical similarities in the attacks and ones uncovered by U.S. tech firms against Uighurs, the report suggested that forces likely working with the Chinese government may be upgrading their surveillance efforts against key minorities more broadly. The Tibetans are protesting the Chinese rule of the mountainous region inside China.

Asked in Beijing about the report, Chinese Foreign Ministry spokesman Geng Shuang said China resolutely opposed and cracked down on any form of internet attacks, and that any accusations needed to be backed up by cast-iron proof.

Citizen Lab, based at the University of Toronto, said it had worked with the recently established Tibetan Computer Emergency Readiness Team (TibCERT), a coalition of Tibetan organizations working on digital security, to probe cyber-attacks that occurred between November 2018 and May 2019.

In the attacks, people posing as human rights workers or journalists contacted unnamed senior figures in Tibetan groups over Facebook's WhatsApp messaging service, according to screenshots featuring their phone numbers posted in the Citizen Lab report. Reuters was not able to independently confirm the authenticity of the screenshots or details of the report.

Among the groups targeted in November 2018 was the private office of Tibetan spiritual leader the Dalai Lama, the Tibetan Parliament, and human rights organizations, the report said.

Using well-crafted cover stories, the attackers tried to entice the targets to click on links to websites that would have installed spyware on Apple or Android devices, the report said.

Eight of the 15 Tibetans known to have received the tainted links recalled clicking on them to open them, the researchers said. All their devices were protected by patches that had been issued for the security flaws, but the researchers followed the links themselves to determine what would have happened.

Citizen Lab said the spyware aimed at the Tibetans had also been used to target Uighurs, a mostly Muslim minority group considered a possible security threat by Beijing, in two campaigns revealed in the past month. One was discovered by Google, and another by security company Volexity.

An Apple spokesman said the company had consulted with Citizen Lab and confirmed that the attack tools would not have worked against the Tibetan targets who had updated their iPhones.

"We always encourage customers to download the latest version of iOS for the best and most current security enhancements," said spokesman Todd Wilder.

China is facing growing international criticism over its treatment of Uighurs in Xinjiang. It has repeatedly denied involvement in cyberattacks or any mistreatment of the Uighur people.

Although lead Citizen Lab researcher Bill Marczak said Citizen Lab found "a very clear nexus with China," he acknowledged that "it doesn't automatically mean it's the government, it's kind of hard to say from a technical point of view."

Lobsang Gyatso, secretary of TibCERT, said that the group would use the report to spread awareness of hacking tactics and promote better defense

Chinese hackers who used a previously unknown iPhone security flaw to target ethnic minority Uighurs also went after Tibetans in exile, according to a report published on Tuesday.

Chinese hackers who used a previously unknown iPhone security flaw to target ethnic minority Uighurs also went after Tibetans in exile, according to a report published on Tuesday. It was the first detected use of malicious software against exiled Tibetans that required only a single click on a mobile device to work, said Citizen Lab, a Canada-based academic research group. Citing the technical similarities in the attacks and ones uncovered by U.S. tech firms against Uighurs, the report suggested that forces likely working with the Chinese government may be upgrading their surveillance efforts against key minorities more broadly. The Tibetans are protesting the Chinese rule of the mountainous region inside China. Asked in Beijing about the report, Chinese Foreign Ministry spokesman Geng Shuang said China resolutely opposed and cracked down on any form of internet attacks, and that any accusations needed to be backed up by cast-iron proof. Citizen Lab, based at the University of Toronto, said it had worked with the recently established Tibetan Computer Emergency Readiness Team (TibCERT), a coalition of Tibetan organizations working on digital security, to probe cyber-attacks that occurred between November 2018 and May 2019. In the attacks, people posing as human rights workers or journalists contacted unnamed senior figures in Tibetan groups over Facebook's WhatsApp messaging service, according to screenshots featuring their phone numbers posted in the Citizen Lab report. Reuters was not able to independently confirm the authenticity of the screenshots or details of the report. Among the groups targeted in November 2018 was the private office of Tibetan spiritual leader the Dalai Lama, the Tibetan Parliament, and human rights organizations, the report said. Using well-crafted cover stories, the attackers tried to entice the targets to click on links to websites that would have installed spyware on Apple or Android devices, the report said. Eight of the 15 Tibetans known to have received the tainted links recalled clicking on them to open them, the researchers said. All their devices were protected by patches that had been issued for the security flaws, but the researchers followed the links themselves to determine what would have happened. Citizen Lab said the spyware aimed at the Tibetans had also been used to target Uighurs, a mostly Muslim minority group considered a possible security threat by Beijing, in two campaigns revealed in the past month. One was discovered by Google, and another by security company Volexity. An Apple spokesman said the company had consulted with Citizen Lab and confirmed that the attack tools would not have worked against the Tibetan targets who had updated their iPhones. "We always encourage customers to download the latest version of iOS for the best and most current security enhancements," said spokesman Todd Wilder. China is facing growing international criticism over its treatment of Uighurs in Xinjiang. It has repeatedly denied involvement in cyberattacks or any mistreatment of the Uighur people. Although lead Citizen Lab researcher Bill Marczak said Citizen Lab found "a very clear nexus with China," he acknowledged that "it doesn't automatically mean it's the government, it's kind of hard to say from a technical point of view." Lobsang Gyatso, secretary of TibCERT, said that the group would use the report to spread awareness of hacking tactics and promote better defense

Chinese hackers who pursued Uighurs also targeted Tibetans: researchers

Chinese hackers have targeted more than two dozen universities in the US and around the globe as part of an elaborate scheme to steal research about maritime technology being developed for military use, cybersecurity experts and current and former US officials said, Dow Jones Newswires reported in an article provided to EFE on Wednesday.

The University of Hawaii, the University of Washington and Massachusetts Institute of Technology are among at least 27 universities in the US, Canada and Southeast Asia that Beijing has targeted, according to iDefense, a cybersecurity intelligence unit of Accenture Security.

The research, to be published this week, is the latest indication that Chinese cyber attacks to steal US military and economic secrets are on the rise. The findings, reviewed by The Wall Street Journal, name a substantial list of university targets for the first time, reflecting the breadth and nature of the cyber campaign iDefense said dates to at least April 2017.

Chinese officials didn't immediately respond to a request for comment but have denied they engage in cyber attacks.

iDefense said it identified targeted universities by observing that their networks were pinging servers located in China and controlled by a Chinese hacking group known to researchers interchangeably as Temp. Periscope, Leviathan or Mudcarp. Researchers at the US cyber firm FireEye, who have studied the same group, said the iDefense findings were generally consistent with their own intelligence.

The majority of the universities targeted either house research hubs focused on undersea technology or have faculty on staff with extensive experience in a relevant field, and nearly all have links to a Massachusetts oceanographic institute that also was likely compromised in the cyber campaign, iDefense said.

Some have been awarded contracts by the Navy. Others, including Sahmyook University in South Korea, appeared to be targeted because of their proximity to China, and relevance to the South China Sea, the analysts said.

Several affected schools aren't named in the report because of investigative efforts related to the cyber campaign, iDefense said. Other people familiar with the hacking activity said the applied research laboratory at Penn State, among the top earners of Defense Department research dollars, was among the targets. Duke University was another, these people said.

The Chinese hacking group, which multiple security firms and officials have linked to Beijing, is the same one that has been linked to breaches of Navy contractors and subcontractors that have resulted in the theft of sensitive military information, such as submarine missile plans and ship-maintenance data.

Most universities named in the report didn't respond to requests for comment, declined to answer questions about the potential breaches, or said they deployed robust cybersecurity measures to protect their networks. Many said they were unaware of any recent theft of sensitive information from their networks.

The Navy said it recognizes the seriousness of cyber threats and is working to bolster defences, but didn't comment on the hacking at universities.

Previous cybersecurity research has identified American universities as a favoured target for Temp. Periscope because they often possess valuable military research and are viewed as having weaker defences than the US armed services or defence contractors.

The cyber attacks appeared to leverage trust between academics at different research institutions to craft spear phishing emails that looked like legitimate messages from one university but instead came loaded with malicious software, according to iDefense, former US officials and other security researchers.

"Universities are pretty willing to share information in pursuit of academic information," said Howard Marshall, who leads iDefense threat intelligence operations. "But as a lot of our adversaries have discovered, that is a sweet spot for them to operate."

Brandon Catalan, an intelligence analyst at iDefense, said many of the targeted universities may have fallen victim to the cyber attacks but that researchers couldn't determine which ones had been breached. But iDefense found that nonpublic files belonging to the University of Hawaii's Applied Research Laboratory were laced with malware and sent to other targets, suggesting a successful intrusion at Hawaii. People familiar with the matter said one of those targets was Penn State.

The University of Hawaii declined to comment. A Penn State spokeswoman said the school immediately notifies the government and relevant partners whenever a breach is encountered. She declined to say whether the university had been compromised.

FireEye researchers corroborated some of iDefense's general findings, though it didn't name specific universities that were targeted. They have observed the group attempt to steal maritime research since 2013 and said it had been the most active of any Chinese hacking group it tracked over the past year. Among other tactics, the hackers have at times posed as journalists or the Navy itself when sending malicious emails to academic targets, FireEye said.

"They are a full-fledged operation," said Ben Read, senior manager for cyber espionage analysis at FireEye. "And they are not going anywhere."

FireEye this week renamed Temp. Periscope, calling it Advanced Persistent Threat 40, or APT 40, a designation the firm reserves for hacking squads it has high confidence it has correctly identified.

Mr Marshall of iDefense, formerly deputy assistant director of the Federal Bureau of Investigation's cyber division, said the Chinese want to steal research to match US weapons capabilities and understand the Pentagon's future plans. "To have knowledge of where our military capabilities are going is of extreme importance to them," he said.

Nearly all of the universities shared a common link to Woods Hole Oceanographic Institution, a research and education nonprofit located in Woods Hole, Mass. iDefense said it had high confidence that Woods Hole's network likely had been breached by the Chinese hackers.

With specialization in marine science and engineering, Woods Hole is the largest independent oceanographic research institution in the US, boasting notable achievements that include locating the Titanic in 1985, more than 70 years after it sunk.

Some of the targeted schools, including MIT, Penn State and the University of Washington, are affiliated with a unit at Woods Hole known as the Acoustic Communications Group, which works on undersea communications technology, according to the nonprofit's website.

That group also partners with the Navy's Naval Undersea Warfare Center in Newport, RI&nbsp;Reports last year said the Temp. Periscope team had hacked into an unidentified company under contract with the warfare centre and stolen secret plans to build a supersonic anti-ship missile planned for use by American submarines.

The hackers also attacked universities that had sent students to a summer fellowship at Woods Hole between 2016 and 2018. iDefense said students may have brought university devices with them to Woods Hole that was compromised and then infected university computers once the students returned to campus.

Woods Hole announced in October 2015 that it had shut its computer network for several hours due to an aggressive cyber attack that FireEye at the time had determined was carried out by Chinese hackers who sought to obtain "intellectual property derived from research activity."

It is possible the 2015 intrusion was also carried out by Temp. Periscope and may be connected to the more recent activity, people familiar with the matter said.

Christopher Land, general counsel for Woods Hole, said the group believes those hackers were kicked off its network in 2015 and has no reason to suspect its systems have been compromised. Woods Hole had implemented added cybersecurity measures since the 2015 intrusion, but recognized it remained an appealing foreign espionage target due to the nature of its work, Mr Land said.

Mr Catalan, the iDefense researcher, said his team's analysis suggested Woods Hole was again compromised. "Just because they [hackers] were removed from a network doesn't mean that they give up," he said.

Chinese hackers have targeted more than two dozen universities in the US and around the globe as part of an elaborate scheme to steal research about maritime technology being developed for military use, cybersecurity experts and current and former US officials said, Dow Jones Newswires reported in an article provided to EFE on Wednesday.

Chinese hackers have targeted more than two dozen universities in the US and around the globe as part of an elaborate scheme to steal research about maritime technology being developed for military use, cybersecurity experts and current and former US officials said, Dow Jones Newswires reported in an article provided to EFE on Wednesday. The University of Hawaii, the University of Washington and Massachusetts Institute of Technology are among at least 27 universities in the US, Canada and Southeast Asia that Beijing has targeted, according to iDefense, a cybersecurity intelligence unit of Accenture Security. The research, to be published this week, is the latest indication that Chinese cyber attacks to steal US military and economic secrets are on the rise. The findings, reviewed by The Wall Street Journal, name a substantial list of university targets for the first time, reflecting the breadth and nature of the cyber campaign iDefense said dates to at least April 2017. Chinese officials didn't immediately respond to a request for comment but have denied they engage in cyber attacks. iDefense said it identified targeted universities by observing that their networks were pinging servers located in China and controlled by a Chinese hacking group known to researchers interchangeably as Temp. Periscope, Leviathan or Mudcarp. Researchers at the US cyber firm FireEye, who have studied the same group, said the iDefense findings were generally consistent with their own intelligence. The majority of the universities targeted either house research hubs focused on undersea technology or have faculty on staff with extensive experience in a relevant field, and nearly all have links to a Massachusetts oceanographic institute that also was likely compromised in the cyber campaign, iDefense said. Some have been awarded contracts by the Navy. Others, including Sahmyook University in South Korea, appeared to be targeted because of their proximity to China, and relevance to the South China Sea, the analysts said. Several affected schools aren't named in the report because of investigative efforts related to the cyber campaign, iDefense said. Other people familiar with the hacking activity said the applied research laboratory at Penn State, among the top earners of Defense Department research dollars, was among the targets. Duke University was another, these people said. The Chinese hacking group, which multiple security firms and officials have linked to Beijing, is the same one that has been linked to breaches of Navy contractors and subcontractors that have resulted in the theft of sensitive military information, such as submarine missile plans and ship-maintenance data. Most universities named in the report didn't respond to requests for comment, declined to answer questions about the potential breaches, or said they deployed robust cybersecurity measures to protect their networks. Many said they were unaware of any recent theft of sensitive information from their networks. The Navy said it recognizes the seriousness of cyber threats and is working to bolster defences, but didn't comment on the hacking at universities. Previous cybersecurity research has identified American universities as a favoured target for Temp. Periscope because they often possess valuable military research and are viewed as having weaker defences than the US armed services or defence contractors. The cyber attacks appeared to leverage trust between academics at different research institutions to craft spear phishing emails that looked like legitimate messages from one university but instead came loaded with malicious software, according to iDefense, former US officials and other security researchers. "Universities are pretty willing to share information in pursuit of academic information," said Howard Marshall, who leads iDefense threat intelligence operations. "But as a lot of our adversaries have discovered, that is a sweet spot for them to operate." Brandon Catalan, an intelligence analyst at iDefense, said many of the targeted universities may have fallen victim to the cyber attacks but that researchers couldn't determine which ones had been breached. But iDefense found that nonpublic files belonging to the University of Hawaii's Applied Research Laboratory were laced with malware and sent to other targets, suggesting a successful intrusion at Hawaii. People familiar with the matter said one of those targets was Penn State. The University of Hawaii declined to comment. A Penn State spokeswoman said the school immediately notifies the government and relevant partners whenever a breach is encountered. She declined to say whether the university had been compromised. FireEye researchers corroborated some of iDefense's general findings, though it didn't name specific universities that were targeted. They have observed the group attempt to steal maritime research since 2013 and said it had been the most active of any Chinese hacking group it tracked over the past year. Among other tactics, the hackers have at times posed as journalists or the Navy itself when sending malicious emails to academic targets, FireEye said. "They are a full-fledged operation," said Ben Read, senior manager for cyber espionage analysis at FireEye. "And they are not going anywhere." FireEye this week renamed Temp. Periscope, calling it Advanced Persistent Threat 40, or APT 40, a designation the firm reserves for hacking squads it has high confidence it has correctly identified. Mr Marshall of iDefense, formerly deputy assistant director of the Federal Bureau of Investigation's cyber division, said the Chinese want to steal research to match US weapons capabilities and understand the Pentagon's future plans. "To have knowledge of where our military capabilities are going is of extreme importance to them," he said. Nearly all of the universities shared a common link to Woods Hole Oceanographic Institution, a research and education nonprofit located in Woods Hole, Mass. iDefense said it had high confidence that Woods Hole's network likely had been breached by the Chinese hackers. With specialization in marine science and engineering, Woods Hole is the largest independent oceanographic research institution in the US, boasting notable achievements that include locating the Titanic in 1985, more than 70 years after it sunk. Some of the targeted schools, including MIT, Penn State and the University of Washington, are affiliated with a unit at Woods Hole known as the Acoustic Communications Group, which works on undersea communications technology, according to the nonprofit's website. That group also partners with the Navy's Naval Undersea Warfare Center in Newport, RI Reports last year said the Temp. Periscope team had hacked into an unidentified company under contract with the warfare centre and stolen secret plans to build a supersonic anti-ship missile planned for use by American submarines. The hackers also attacked universities that had sent students to a summer fellowship at Woods Hole between 2016 and 2018. iDefense said students may have brought university devices with them to Woods Hole that was compromised and then infected university computers once the students returned to campus. Woods Hole announced in October 2015 that it had shut its computer network for several hours due to an aggressive cyber attack that FireEye at the time had determined was carried out by Chinese hackers who sought to obtain "intellectual property derived from research activity." It is possible the 2015 intrusion was also carried out by Temp. Periscope and may be connected to the more recent activity, people familiar with the matter said. Christopher Land, general counsel for Woods Hole, said the group believes those hackers were kicked off its network in 2015 and has no reason to suspect its systems have been compromised. Woods Hole had implemented added cybersecurity measures since the 2015 intrusion, but recognized it remained an appealing foreign espionage target due to the nature of its work, Mr Land said. Mr Catalan, the iDefense researcher, said his team's analysis suggested Woods Hole was again compromised. "Just because they [hackers] were removed from a network doesn't mean that they give up," he said.

Chinese hackers target universities in US to steal research about maritime technology: Report

US slams China for corporate cyber espionage, indicts two spies

chinese-hackers

Chinese Hackers, News on Chinese Hackers, stories on Chinese Hackers, articles on Chinese Hackers, Chinese Hackers stories at Wion, Chinese Hackers news, Chinese Hackers latest news

chinese hackers