financetom
Business
financetom
/
Business
/
Factbox-APT31: the Chinese hacking group behind global cyberespionage campaign
News World Market Environment Technology Personal Finance Politics Retail Business Economy Cryptocurrency Forex Stocks Market Commodities
Factbox-APT31: the Chinese hacking group behind global cyberespionage campaign
Mar 26, 2024 2:08 AM

(Reuters) - The United States and Britain filed charges and imposed sanctions on a company and individuals tied to a Chinese state-backed hacking group named APT31 that they allege engaged in a sweeping cyber espionage campaign.

This group was allegedly run by China's Ministry of State Security and targeted millions of people, mostly in the U.S. and Britain, for more than a decade including officials, lawmakers, activists, academics and journalists, and firms ranging from defence contractors to a U.S. smartphone maker.

China has denied the charges.

"We urge the U.S. and British sides to stop politicising the issue of cybersecurity, stop slandering and smearing China and imposing unilateral sanctions, and stop cyber-attacks against China," foreign ministry spokesman Lin Jian said.

WHAT IS APT31?

Advanced Persistent Threat Group 31 (APT31) is a collective of Chinese state-sponsored intelligence officers, contract hackers and attendant staff that engage in hacking activities and "malicious cyber operations" according to the U.S. Treasury department in a statement. APTs are a general term for cyber actors or groups, often state-backed, that engage in malicious cyber activities.

The group, also known as Zirconium, operated through a front company, Wuhan Xiaoruizhi Science and Technology Company (Wuhan XRZ), from at least 2010 until January 2024, according to a U.S. indictment filed in New York's eastern district court on Monday. It is allegedly linked to China's Ministry of State Security (MSS) in the province of Hubei.

Separately, the New Zealand government claimed on March 25 that another state-backed Chinese hacking group, APT40, was behind a hack of its parliament in 2021.

WHAT IS APT31 ACCUSED OF DOING?

APT31 and Chinese security authorities targeted thousands of U.S. and foreign politicians, foreign policy experts and others as part of the MSS's foreign intelligence and economic espionage objectives according to the U.S. Individuals in the White House, State Department, and spouses of officials were also targets.

Often the hacks were conducted in relation to geopolitical events affecting China, including economic tensions with the U.S., maritime claims in the South China Sea and the Hong Kong pro-democracy protests in 2019 and subsequent crackdown, the U.S. indictment alleges.

The conspiracy involved over 10,000 malicious emails across multiple continents in a "prolific global hacking operation" backed by Beijing, the indictment alleged. The aims included repressing critics of Beijing, compromising government institutions and stealing trade secrets, U.S. authorities said.

The U.S. Treasury department's office of foreign assets control (OFAC) sanctioned Wuhan XRZ and 7 Chinese individuals on March 25, including Ni Gaobin and Zhao Guangzong.

The British government also sanctioned the same Wuhan company along with the two men, Ni and Zhao. British authorities alleged they were behind a 2021 hack of emails belonging to the Inter-Parliamentary Alliance on China (IPAC), a British group with ties to an international network of politicians critical of China; as well as a 2021-2022 cyber-attack on Britain's Electoral Commission.

WHAT DO WE KNOW ABOUT THOSE SANCTIONED?

The seven men, aged between 34-38, in the U.S. indictment stand accused of hacking activities in support of MSS foreign intelligence and economic espionage objectives.

Wuhan XRZ is formally listed as a firm engaged in technology development and consulting on China's Qichacha company information database with less than 50 staff. It is based in a technology development zone in Wuhan's south-eastern suburbs.

The firm and APT 31 were "responsible for, engaging in, or providing support for the commission, planning, or preparation of relevant cyberactivity on behalf of the Chinese State," the British government wrote on its updated sanctions list.

The current legal owner is listed as Wang Hongye, who took over from a previous owner in late 2023. The firm was established in 2010 with registered capital of 250,000 yuan.

U.S. authorities have offered rewards of up to $10 million for information on the hackers.

Ni, a 38-year-old Chinese citizen sanctioned by both the U.S. and U.K., was also singled out by the U.S. for targeting Hong Kong democracy activists and lawmakers, and members of the Uyghur minority group, through spear-phishing campaigns and information systems interference.

In recent years, China has clamped down on dissidents in Hong Kong and the northwestern region of Xinjiang, home to many Uyghurs.

(Additional reporting by Yew Lun Tian in Beijing and Hong Kong newsroom; Editing by Raju Gopalakrishnan)

Comments
Welcome to financetom comments! Please keep conversations courteous and on-topic. To fosterproductive and respectful conversations, you may see comments from our Community Managers.
Sign up to post
Sort by
Show More Comments
Related Articles >
Oil eases on possible Gaza ceasefire, dollar strength
Oil eases on possible Gaza ceasefire, dollar strength
Mar 21, 2024
SINGAPORE (Reuters) -Oil prices slipped on Friday on the possibility of a nearing Gaza ceasefire that could ease geopolitical concerns in the Middle East, while a stronger dollar and faltering U.S. gasoline demand also weighed on prices. Brent crude futures fell 42 cents, or 0.5%, to $85.36 a barrel by 0203 GMT. U.S. crude futures shed 40 cents, or 0.5%,...
Ecopetrol's Reficar refinery awarded nearly 20% of McDermott common capital, company says
Ecopetrol's Reficar refinery awarded nearly 20% of McDermott common capital, company says
Mar 21, 2024
BOGOTA, March 21 (Reuters) - The Reficar oil refinery belonging to Colombia's Ecopetrol was awarded 19.9% of the common capital in infrastructure firm McDermott in preferential shares by a judge in Amsterdam, Ecopetrol said in a statement on Thursday. The refinery is located in the Colombian city of Cartagena. ...
Hong Kong-listed Samsonite plans dual listing in hunt for investors
Hong Kong-listed Samsonite plans dual listing in hunt for investors
Mar 21, 2024
(Reuters) -Luggage maker Samsonite International ( SMSOF ) on Friday said it plans to pursue a dual listing in addition to its listing on the Hong Kong Stock Exchange to increase the liquidity of its shares and reach investors in more markets. Samsonite ( SMSOF ) did not provide details of the exchanges it is considering for the second listing,...
Meta's Instagram down for thousands, Downdetector shows
Meta's Instagram down for thousands, Downdetector shows
Mar 21, 2024
March 21 (Reuters) - Meta Platforms's ( META ) Instagram was down for thousands of users on Thursday, according to outage tracking website Downdetector.com. ...
Copyright 2023-2026 - www.financetom.com All Rights Reserved