Chinese hacking groups are bullying telecoms as 2020 goes on, CrowdStrike says

Six hacking groups have focused on the telecommunications sector in the first half of this year, according to new CrowdStrike research.

Six suspected Chinese hacking groups have zeroed-in on entities in the telecommunications sector in the first half of this year, according to CrowdStrike research published Tuesday.

While CrowdStrike did not identify the groups by name, attackers have likely been running their hacking operations in an effort to steal sensitive data about targets, or to conduct intellectual property theft, researchers at the threat intelligence firm determined. CrowdStrike also did not identify the targets.

The telecommunications sector was among the top most-targeted sectors in the first half of 2020, the company said, alluding to behavior that aligns with previous espionage patterns from hackers with suspected ties to Beijing. Publication of the report coincides with a fresh warning from the U.S. Department of Homeland Security that a Chinese intelligence agency is exploiting known software flaws to gather information from U.S. federal agencies, and amid an ongoing U.S. government effort to safeguard research into a COVID-19 vaccine, which Chinese hackers are alleged to have targeted.

Chinese hackers have gained infamy in U.S. government circles for alleged IP theft, though in recent years some groups have honed their ability to conduct targeted surveillance, according to security practitioners. Last year, a group known as APT41 tracked down specific data on individuals by breaching a phone company, according to research from FireEye. That group, FireEye determined, conducts espionage operations for China’s Communist Party, and also has focused on individuals of interest to the Chinese government, including those discussing the military or protests in Hong Kong.

Hackers based in China also compromised cellular providers in Africa, Europe, the Middle East, and Asia last year, according to Cybereason research.

China’s potential ability to tap into Chinese-owned telecommunications firms has roiled corporate efforts to build out 5G networks in the U.S. and allied nations. U.S. intelligence officials and lawmakers have said Beijing is able to leverage access to Chinese-owned firms, such as Huawei, for data collection purposes.

In recent months U.S. national security officials urged the Federal Communications Commission to block a Chinese state-owned telecommunications firm from providing service to American customers over concerns about espionage or disruption to service.

Chinese government officials, and Huawei executives consistently have denied engaging in cyber-espionage.

While Chinese threat actors dedicated a significant amount of attention to targeting telecommunications entities in the first half of this year, Chinese actors have also targeted health care, pharmaceutical, and manufacturing entities, according to CrowdStrike. From January to June, manufacturing was the second most-targeted sector overall, a marked shift from where it normally falls, according to CrowdStrike’s tracking. Last year, for instance, it was not among the top ten most frequently targeted sectors.

Meanwhile, medical entities overall were the fifth most-targeted from January to June this year.

The Department of Defense, the NSA, the Department of Homeland Security, and the FBI recently launched an effort to stop hackers from disrupting work toward a coronavirus vaccine, as CyberScoop first reported. Hackers’ interest in manufacturing entities could be tied to the race to develop and manufacture coronavirus vaccines amid the ongoing pandemic.

Chinese actors associated with a Chinese intelligence agency, the Ministry of State Security, have targeted coronavirus vaccine research in the U.S. this year, according to the Justice Department.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure