Justice Department official accuses China of acting as ‘safe haven’ for cybercriminals

It’s an accusation that U.S. government officials and security researchers have more often leveled at Russia.

China is increasingly tolerant of criminal hackers on its soil if they are willing to hack on behalf of the Chinese government, a senior U.S. Justice Department official has alleged.

Recent U.S. indictments of accused Chinese hackers indicate that the country “has become a safe haven for cybercriminals as long as they’re also doing work on behalf of the state,” John Demers, the assistant attorney general for national security, alleged in an interview for CyberTalks, the annual summit produced by Scoop News Group. “That’s very worrisome…because now you’ve got a country that’s giving free rein to criminal hackers.”

It’s an accusation that U.S. government officials and security researchers have frequently leveled against Russia, as well. The blend, though, of criminal and state-sponsored activity in China will make it even more difficult for U.S. companies to defend themselves, Demers said.

A spokesperson for the Chinese Embassy in Washington, D.C., called the allegations “groundless,” adding: “China is a staunch guardian of cyber security and one of the biggest victims of hacking.”

Two U.S. indictments unsealed in September charged five Chinese nationals with conducting computer intrusions for personal profit, but also with hacking students in Taiwan and Hong Kong, actions traditionally associated with state-sponsored activity. One of the men charged allegedly claimed protection from the Ministry of State Security, China’s civilian intelligence agency. That is “similar to what we saw the Russians doing with hackers in the past, that kind of a bargain that they’ll make with these criminal hackers,” Demers said.

While Russia’s cybercriminal underground gets more public attention, there are also forums in China where malicious hackers trade tools and tips. One of the most notable schemes saw Chinese hackers allegedly defraud Facebook users of $4 million by installing malicious software on computers and buying up Facebook advertisements. Facebook said the perpetrators did not appear to have any affiliation with the Chinese state.

The U.S. indictments were revealed about a year after security company FireEye exposed the alleged Chinese state-backed espionage group known as APT41. The FireEye report helped lift the veil on Chinese hackers’ alleged moonlighting, suggesting where espionage might end, and where self-enrichment seemed to begin. U.S. prosecutors invoked the APT41 label in the recent indictment.

Demers also said that Chinese espionage campaigns have been using front companies to try to cover their tracks, a tactic that Iranian hackers also have allegedly used. Three of the men who were recently indicted worked for what was ostensibly a China-based cybersecurity company called Chengdu 404 Network Technology. But behind public statements that they provided security testing for companies, Chengdu 404 employees were allegedly hacking government networks in India and Vietnam using “commercial penetration testing tools,” according to the indictment.

“Attribution is hard and nation-states and obviously criminal hackers will try to make it harder. But it’s still very doable,” Demers said.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure