DHS briefs industry on shift in Chinese hacking that 'increases the risk for all of us'

In a webinar for the private sector, DHS detailed how APT10 and other groups have evolved. The U.S. officials urged companies to better secure IT services that can be an avenue for stealing proprietary data.

U.S. officials on Wednesday continued to warn industry about the threat posed by Chinese government-backed hackers by detailing how those teams have evolved and urging companies to better secure IT services that can be an avenue for stealing proprietary data.

“Their strategies have shifted from labor-intensive, one-off compromises of individual targets to the use of the force-multiplier effects that enable them to compromise multiple targets through a single attack,” Rex Booth, a Department of Homeland Security cyber official, said during a webinar presentation to the private sector. “That shift in strategies increases the risk for all of us.”

The public webinar focused on APT10, a group tied to China’s civilian intelligence agency, the Ministry of State Security. Analysts say the MSS has supplanted the People’s Liberation Army to become Beijing’s preferred arm for conducting economic espionage.

U.S. officials and security researchers say APT10 has targeted the “managed service providers” that corporations use for IT configuration, exploiting that access to scope the networks of data-rich companies.

“This type of activity has the potential to be used much more widely to affect millions more internet users around the globe,” said Chris Krebs, head of DHS’s Cybersecurity and Infrastructure Security Agency.

Booth said that while DHS had seen a downturn in activity from APT10 since the Department of Justice announced charges against two of its alleged operatives in December, “That doesn’t mean we should drop our guard.”

Beijing’s alleged economic espionage is directly tied to the Chinese government’s five-year strategic plans, Booth said. “Those plans read like a blueprint for the likely targets of Chinese espionage.” The Chinese government has denied allegations it uses hacking to steal corporate data.

The briefing came hours after cybersecurity companies Recorded Future and Rapid7 revealed a 2017-18 cyber-espionage campaign that APT10 allegedly conducted against a European software provider, American law firm, and a global apparel company.

By making more forensics on APT10’s operations public, government and corporate officials are trying to prevent future breaches. Eoin Miller, an analyst at Rapid7, advised organizations to carefully review attempts to communicate with their VPN providers from unusual networks or countries.

DHS analysts echoed that advice during the webinar, and offered a mix of technical mitigations and general warnings.

“[O]ur underlying message here is: you can outsource your operations, but you cannot outsource your risk,” Krebs said.

The DHS briefing is part of a broader pressure campaign that the Trump administration is putting on Beijing to curtail its alleged sponsorship of hacking and espionage operations to steal U.S. intellectual property.

“We are now making it clear to China that after years of targeting our industries, and stealing our intellectual property, the theft of American jobs and wealth has come to an end,” President Donald Trump said in his State of the Union address Tuesday.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure