German drug giant Bayer breached by Chinese hacking group Wicked Panda: report

The pharmaceutical giant said it found malicious software on its computer networks last year.

German drug conglomerate Bayer says it was victimized in a cyberattack that appears to have originated with Chinese hackers, German media reported Thursday.

The $39 billion pharmaceutical giant said it found malicious software on its computer networks last year and contained the breach, according to the outlets BR and NDR.

Investigators examining the breach said attackers used the Winnti malware, which is tied to a Chinese-based hacking group known as Wicked Panda. The group in the past has been blamed for attacks on targets including the online gambling industry and companies with intellectual property that would benefit Beijing.

Wicked Panda “makes use of a number of open-source and custom tools to infect and move laterally in victim networks,” according to a CrowdStrike description. “The group’s tools have been traced to “contractors who count multiple Chinese government agencies as clients, including the Ministry of Public Security. Observed targeting by the Wicked Panda adversary has focused on high-value entities in the engineering, manufacturing and technology sectors, aligning with the PRC’s strategic economic plans.”

When the initial breach occurred was not immediately clear. An investigation is still underway though an initial probe found “no evidence of data theft” at Bayer or personal information being stolen from third parties, the company said.

Bayer is the largest drug company in Germany and the largest agricultural supplies company in the world.

Hackers have increased their attacks against high-value Germany targets in recent years. The Winnti malware was used against the technology company ThyssenKrupp in 2016, a breach that resulted in the theft of technical trade secrets from that firms; steel production and manufacturing plant design divisions, Reuters reported.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure