China's global theft of commercial secrets

China hacked Norway's Visma to steal client secrets

By Jack Stubbs

LONDON -- Hackers working on behalf of Chinese intelligence breached the network of Norwegian software firm Visma to steal secrets from its clients, cybersecurity researchers said, in what a company executive described as a potentially catastrophic attack.
The attack was part of what Western countries said in December is a global hacking campaign by China's Ministry of State Security to steal intellectual property and corporate secrets, according to investigators at cybersecurity firm Recorded Future.
China's Ministry of State Security has no publicly available contacts. 

The foreign ministry did not respond to a request for comment.
Visma took the decision to talk publicly about the breach to raise industry awareness about the hacking campaign, which is known as Cloudhopper and targets technology service and software providers in order reach their clients.
Cybersecurity firms and Western governments have warned about Cloudhopper several times since 2017 but have not disclosed the identities of the companies affected.
Reuters reported in December that Hewlett Packard Enterprise Co and IBM were two of the campaign's victims, and Western officials caution in private that there are many more.
At the time IBM said it had no evidence sensitive corporate data had been compromised, and Hewlett Packard Enterprise said it could not comment on the Cloudhopper campaign.
Visma, which reported global revenues of $1.3 billion last year, provides business software products to more than 900,000 companies across Scandinavia and parts of Europe.
The company's operations and security manager, Espen Johansen, said the attack was detected shortly after the hackers accessed Visma's systems and he was confident no client networks were accessed.

"PARANOIA HAT"
"But if I put on my paranoia hat, this could have been catastrophic," he said. 

"If you are a big intelligence agency somewhere in the world and you want to harvest as much information as possible, you of course go for the convergence points, it's a given fact."
"I'm aware that we do have clients which are very interesting for nation states," he said, declining to name any specific customers.
Paul Chichester, director for operations at Britain's National Cyber Security Centre, said the Visma case highlighted the dangers organisations increasingly face from cyber attacks on their supply chains.
"Because organisations are focused on improving their own cyber security, we are seeing an increase in activity targeting supply chains as actors try to find other ways in," he said.
In a report https://www.recordedfuture.com/apt10-cyberespionage-campaign with investigators at cybersecurity firm Rapid7, Recorded Future said the attackers first accessed Visma's network by using a stolen set of login credentials and were operating as part of a hacking group known as APT 10, which Western officials say is behind the Cloudhopper campaign.
The U.S. Department of Justice in December charged two members of APT 10 with hacking U.S. government agencies and dozens of businesses around the world on behalf of China's Ministry of State Security.
Priscilla Moriuchi, director of strategic threat development at Recorded Future and a former intelligence officer at the U.S. National Security Agency, said the hackers' activity inside Visma's network suggested they intended to infiltrate client systems in search of commercially-sensitive information.
"We believe that APT 10 in this case exploited Visma networks to enable secondary operations against Visma's customers, not necessarily to steal Visma's own intellectual property," she said. "Because they caught it so early they were able to discourage and prevent those secondary attacks." 

Cyberespionage Experts Want to Know Who’s Exposing China’s Hacking Army

Group called Intrusion Truth has published information online about Chinese hacking campaigns
By Robert McMillan

A round of finger-pointing has erupted in the cybersleuth community over who is behind the effort to expose Chinese hacking.

The world’s cybersleuths are investigating a new mystery: Who is behind an anonymous effort to expose China’s hacker army?
An anonymous group calling itself Intrusion Truth in August published a blog post about one of the most prolific suspected China-linked hacking groups tracked by cybersecurity researchers. 

It was the latest in a series of online messages and blog posts dating back to May 2017 that outlined two Chinese hacking campaigns, including providing the names of suspected hackers. 

Separately, two of those named were later charged by U.S. authorities.
Security researchers say they don’t know who is behind Intrusion Truth. 

The group’s method of anonymously dumping information and targeting a foreign intelligence agency is something new, they say, and exposing illegal activity could up the pressure on Chinese companies cooperating with state-sponsored hacking efforts.
U.S. officials and security researchers have linked Chinese hackers for years to government-backed computer intrusions into U.S. companies. 

Intrusion Truth’s anonymity might itself be a clue to its identity. 

Some large corporations and security companies that employ researchers who track China’s hackers might be reluctant to release findings for fear of reprisals from China’s government, said Ben Read, who manages cyberespionage investigations at FireEye Inc.
Intrusion Truth named individual culprits—unusual in the world of nation-state hacking research—posted photographs, dug up hackers’ places of work and even revealed Uber receipts that appeared to link the individuals to particular addresses in China.
That is the kind of expert sleuthing few people would have the language skills, tools and research abilities to pull off, said Thomas Rid, a professor at Johns Hopkins University.
“It’s somebody who is professional,” he said, “somebody who knows what they’re doing.”
A round of finger-pointing has erupted in the cybersleuth community over who is behind Intrusion Truth. 

One theory is the group may work for a corporate victim of Chinese hackers.
“There are a whole load of people accusing each other,” one researcher said. 

He said he has received multiple messages asking whether he is part of Intrusion Truth.
Intrusion Truth has published dozens of messages to Twitter and more than a dozen posts to the blog site Medium over the past 16 months.
In them, it has posted evidence linking Chinese companies to a China-backed hacking group known as APT 3 and another known as APT 10, or Stone Panda, shedding light on the continued threat of Chinese hacking.
“APT 10 is one of the most active groups we track,” said Mr. Read. 

The group has hacked companies in Japan and Europe, and has targeted entities in the U.S., he said.
Intrusion Truth also has zeroed in on several Chinese companies, alleging they are linked to government-backed hacking campaigns.
“We are focusing our efforts on determining whether these are just ‘companies that hack,’ or would they be better described as fronts enabling the Chinese state to employ hackers who can later be scapegoated as criminals?” Intrusion Truth said in a Twitter message in August.

Early last year, the group said two employees of Guangdong Bo Yu Information Technology Co., known as Boyusec, were part of APT 3. 

Six months later, U.S. authorities indicted the men—Wu Yingzhuo and Dong Hao—saying they were involved in APT 3 computer intrusions at Moody’s Analytics and the German engineering company Siemens AG .
Wu and Dong couldn’t be reached for comment. 

Representatives from Boyusec, which dissolved before the indictments were unsealed, couldn’t be reached.
Intrusion Truth didn’t respond to messages seeking comment. 

In late August, the group said its aim is to make Chinese hackers “think twice about their illegal online activities,” according to Motherboard.
Intrusion Truth linked internet domains and email addresses associated with websites used by APT 10 to two other Chinese companies, Tianjin Huaying Haitai Science and Technology Development Co. and Laoying Baichaun Instruments Equipment Co.
A woman answering a number listed for Huaying Haitai hung up when asked for comment. 

Laoying Baichaun couldn’t be reached.
Typically, Intrusion Truth posts data that could be uncovered online or via research tools used by professional threat analysts. 

The APT 10 evidence, though, included material that would have been harder to obtain: copies of Uber receipts belonging to an employee who had worked at the two companies.
Intrusion Truth says these receipts show travel by this person to a building operated by China’s intelligence agency. 

The agency doesn’t accept media inquiries.
CrowdStrike Inc., which tracks Chinese hacking campaigns, in late August published a blog post agreeing with much of what Intrusion Truth had reported on APT 10.
“The information they have access to goes way beyond what we would have access to,” said Adam Meyers, an executive with the cybersecurity firm.