Nation of Thieves

U. S. charges Chinese hackers in theft of vast trove of confidential data in 12 countries

By Ellen Nakashima and David J. Lynch

Prosecutors unsealed an indictment charging two Chinese with computer hacking attacks on a wide range of U.S. government agencies and corporations. 

The United States and four of its closest allies on Thursday blamed China for a 12-year campaign of cyberattacks that vacuumed up technology and trade secrets from corporate computers in 12 countries, affecting almost every major global industry.
The coordinated announcements in five capitals marked the Trump administration’s broadest anti-China initiative to date, yet it fell short of even stronger measures that officials had planned.
During debate, Treasury Secretary Steven Mnuchin blocked a proposal to impose financial sanctions on those implicated in the hacking, according to five sources familiar with the matter. 

Two administration officials said Mnuchin acted out of fear that sanctions would interfere with U.S.-China trade talks.
The centerpiece of Thursday’s synchronized accusations came in Washington, where the Justice Department unveiled indictments against two Chinese hackers, who it said acted “in association with” the Chinese Ministry of State Security (MSS).
Zhu Hua and Zhang Shilong, members of a hacking squad known as “Advanced Persistent Threat 10” or “Stone Panda,” were accused of conspiracy to commit computer intrusions, wire fraud and aggravated identity theft while pilfering “hundreds of gigabytes” of confidential business data, the indictment said.
“China’s goal, simply put, is to replace the U.S. as the world’s leading superpower, and they’re using illegal methods to get there,” said FBI Director Christopher A. Wray.
U.S. allies echoed the Justice Department action, signaling a growing consensus that Beijing is flouting international norms in its bid to become the world’s predominant economic and technological power.

Xi Jinping's empty promises

In the capitals of the United Kingdom, Australia, Canada and New Zealand, ministers knocked China for violating a 2015 pledge — offered by Chinese dictator Xi Jinping in the White House’s Rose Garden and repeated at international gatherings such as the Group of 20 summit — to refrain from hacking for commercial gain.
“This campaign is one of the most significant and widespread cyber intrusions against the U.K. and allies uncovered to date, targeting trade secrets and economies around the world,” British Foreign Secretary Jeremy Hunt said in a statement.
Still, some administration allies were skeptical that Thursday’s announcement would alter China’s behavior.

Deputy Attorney General Rod J. Rosenstein announces on Thursday the indictments of two Chinese for hacking attacks. 

“Just as when the Obama administration did it, indicting a handful of Chinese agents out of the tens of thousands involved in economic espionage is necessary but not important,” said Derek Scissors, a China analyst at the American Enterprise Institute. 

“International denouncements may irritate Xi, but they place no real pressure on him.”
Scissors said it would be more effective for the United States to hit high-profile Chinese companies with financial sanctions, including potential bans on their ability to do business with American companies.
The five governments that joined in the statements about China are partners in the “Five Eyes” intelligence alliance, sharing some of their most closely guarded technical and human reporting.
The foreign ministries of Denmark, Sweden and Finland tweeted statements saying they shared the concerns over rampant cyberespionage against corporations.
The united front against Chinese hacking and economic espionage stands in contrast to the “America First” president’s preference for taking a unilateral course to many of his trade goals.
“This demonstrates there’s a strong well of international support the United States can tap... Countries are fed up,” said Ely Ratner, executive vice president of the Center for a New American Security.
The hackers named in the indictment presided over a state-backed campaign of cybertheft that targeted advanced technologies with commercial and military applications. 

They also hacked into companies called “managed service providers,” which act as gatekeepers to computer networks serving scores of corporate clients.
The Chinese targeted companies in the finance, telecommunications, consumer electronics and medical industries, along with U.S. government laboratories operated by the National Aeronautics and Space Administration and the military.
Along with the United States and the United Kingdom, countries targeted by China include Canada, France, Germany, Japan, Sweden and Switzerland.
“The list of victim companies reads like a who’s who of the global economy,” said Wray.
The Stone Panda team made off with personal information, including Social Security numbers belonging to more than 100,000 U.S. Navy personnel.
The hackers employed a technique known as “spear-phishing,” tricking computer users at the business and government offices into opening malware-infected emails giving them access to log-in and password details.
They worked out of an office in Tianjin, China, and engaged in hacking operations during working hours in China.
Geoffrey Berman, the U.S. attorney for the Southern District of New York, called the Chinese ­cyber-campaign “shocking and outrageous.”
Over the past seven years, more than 90 percent of cases alleging economic espionage involved China as did more than two-thirds of trade-secret theft prosecutions, according to Deputy Attorney General Rod J. Rosenstein.
The industries targeted in the Stone Panda hacks are featured in the Chinese government’s Made in China 2025 program, which aims to supplant the United States as the global leader in 10 advanced technologies including artificial intelligence, robotics and quantum computing, Rosenstein added.

In November, in one of his last official actions, then-Attorney General Jeff Sessions announced a major initiative to combat Chinese commercial spying, building on four years of prosecutorial effort. The department vowed to aggressively pursue trade-secret theft cases and identify researchers and defense industry employees who have been “co-opted” by Chinese agents seeking to transfer technology to China.
While the show of anti-China unity was notable, the administration pulled back from plans for tougher action after warnings from the treasury secretary.
Mnuchin’s 11th-hour intervention left administration officials fearing Beijing would view the limited actions as a sign that Trump lacks the stomach for an all-out confrontation.
“We don’t comment on sanctions actions or deliberations, but it’s important to note that these issues are completely separate from trade,” said a Treasury Department spokesman asked to comment on the reports.
The administration’s action entailed statements from four Cabinet agencies — Justice, State, Energy and Homeland Security — while Treasury remained on the sidelines.
The condemnations also pose a complication as Trump and Xi seek to negotiate a trade deal. 

Over dinner in Buenos Aires earlier this month, the two leaders agreed to a truce in their months-long tariff war.
Talks between U.S. and Chinese diplomats are expected to begin early next month.
The Trump administration is seeking a deal that would involve structural changes to China’s state-led economic model, greater Chinese purchases of American farm and industrial products and a halt to what the United States says are coercive joint-venture licensing terms.
The indictments were followed by a joint statement from Secretary of State Mike Pompeo and Homeland Security Secretary Kirstjen Nielsen that assailed China for violating Xi’s landmark 2015 pledge to refrain from hacking U.S. trade secrets and intellectual property to benefit Chinese companies.
“These actions by Chinese actors to target intellectual property and sensitive business information present a very real threat to the economic competitiveness of companies in the United States and around the globe,” they said.
Thursday’s push to confront China over its cyber-aggression comes at a fraught time, as Canada has arrested a Chinese telecommunications executive at the United States’ request on a charge related to violating sanctions against Iran.

Cyberespionage Experts Want to Know Who’s Exposing China’s Hacking Army

Group called Intrusion Truth has published information online about Chinese hacking campaigns
By Robert McMillan

A round of finger-pointing has erupted in the cybersleuth community over who is behind the effort to expose Chinese hacking.

The world’s cybersleuths are investigating a new mystery: Who is behind an anonymous effort to expose China’s hacker army?
An anonymous group calling itself Intrusion Truth in August published a blog post about one of the most prolific suspected China-linked hacking groups tracked by cybersecurity researchers. 

It was the latest in a series of online messages and blog posts dating back to May 2017 that outlined two Chinese hacking campaigns, including providing the names of suspected hackers. 

Separately, two of those named were later charged by U.S. authorities.
Security researchers say they don’t know who is behind Intrusion Truth. 

The group’s method of anonymously dumping information and targeting a foreign intelligence agency is something new, they say, and exposing illegal activity could up the pressure on Chinese companies cooperating with state-sponsored hacking efforts.
U.S. officials and security researchers have linked Chinese hackers for years to government-backed computer intrusions into U.S. companies. 

Intrusion Truth’s anonymity might itself be a clue to its identity. 

Some large corporations and security companies that employ researchers who track China’s hackers might be reluctant to release findings for fear of reprisals from China’s government, said Ben Read, who manages cyberespionage investigations at FireEye Inc.
Intrusion Truth named individual culprits—unusual in the world of nation-state hacking research—posted photographs, dug up hackers’ places of work and even revealed Uber receipts that appeared to link the individuals to particular addresses in China.
That is the kind of expert sleuthing few people would have the language skills, tools and research abilities to pull off, said Thomas Rid, a professor at Johns Hopkins University.
“It’s somebody who is professional,” he said, “somebody who knows what they’re doing.”
A round of finger-pointing has erupted in the cybersleuth community over who is behind Intrusion Truth. 

One theory is the group may work for a corporate victim of Chinese hackers.
“There are a whole load of people accusing each other,” one researcher said. 

He said he has received multiple messages asking whether he is part of Intrusion Truth.
Intrusion Truth has published dozens of messages to Twitter and more than a dozen posts to the blog site Medium over the past 16 months.
In them, it has posted evidence linking Chinese companies to a China-backed hacking group known as APT 3 and another known as APT 10, or Stone Panda, shedding light on the continued threat of Chinese hacking.
“APT 10 is one of the most active groups we track,” said Mr. Read. 

The group has hacked companies in Japan and Europe, and has targeted entities in the U.S., he said.
Intrusion Truth also has zeroed in on several Chinese companies, alleging they are linked to government-backed hacking campaigns.
“We are focusing our efforts on determining whether these are just ‘companies that hack,’ or would they be better described as fronts enabling the Chinese state to employ hackers who can later be scapegoated as criminals?” Intrusion Truth said in a Twitter message in August.

Early last year, the group said two employees of Guangdong Bo Yu Information Technology Co., known as Boyusec, were part of APT 3. 

Six months later, U.S. authorities indicted the men—Wu Yingzhuo and Dong Hao—saying they were involved in APT 3 computer intrusions at Moody’s Analytics and the German engineering company Siemens AG .
Wu and Dong couldn’t be reached for comment. 

Representatives from Boyusec, which dissolved before the indictments were unsealed, couldn’t be reached.
Intrusion Truth didn’t respond to messages seeking comment. 

In late August, the group said its aim is to make Chinese hackers “think twice about their illegal online activities,” according to Motherboard.
Intrusion Truth linked internet domains and email addresses associated with websites used by APT 10 to two other Chinese companies, Tianjin Huaying Haitai Science and Technology Development Co. and Laoying Baichaun Instruments Equipment Co.
A woman answering a number listed for Huaying Haitai hung up when asked for comment. 

Laoying Baichaun couldn’t be reached.
Typically, Intrusion Truth posts data that could be uncovered online or via research tools used by professional threat analysts. 

The APT 10 evidence, though, included material that would have been harder to obtain: copies of Uber receipts belonging to an employee who had worked at the two companies.
Intrusion Truth says these receipts show travel by this person to a building operated by China’s intelligence agency. 

The agency doesn’t accept media inquiries.
CrowdStrike Inc., which tracks Chinese hacking campaigns, in late August published a blog post agreeing with much of what Intrusion Truth had reported on APT 10.
“The information they have access to goes way beyond what we would have access to,” said Adam Meyers, an executive with the cybersecurity firm.