China-linked hackers have targeted Malaysian government, officials warn

The alleged Chinese spying on Malaysian government organizations fits Beijing's pattern of using cyber-operations to project power in the region.

A hacking group that private researchers have linked with Chinese interests has successfully targeted Malaysian government officials in an apparent data-stealing espionage campaign, cybersecurity officials in the Southeast Asian nation said this week.

The Malaysian Computer Emergency Response Team, a government-backed organization, said it had “observed an increase in [the] number of artifacts and victims involving a campaign against Malaysian government officials.”

The hackers have tended to target government-backed projects in an effort to steal reams of data on proposal and shipping information, the Malaysian officials said. To do that, the attackers have exploited a pair of old vulnerabilities, one dating back to 2014, in Microsoft products to compromise their targets.

The advisory did not explicitly name the hacking group responsible. But the data it cited, including private-sector reports, point to a state-sponsored group known as APT40 or Leviathan.

Active since at least 2013, APT40 has conducted hacking operations in countries around the world in support of China’s Belt and Road Initiative, according to cybersecurity company FireEye. Malaysia has made territorial claims in the South China Sea, a region that China has looked to dominate.

The alleged Chinese spying on Malaysian government organizations fits Beijing’s pattern of using cyber-operations to project power in the region. Another China-linked group has repeatedly try to break into Cambodian government networks.

A spokesperson at the Chinese Embassy in Washington, D.C., did not immediately respond to a request for comment.

Relentless DADJOKEs

Brian Bartholomew, a security researcher at cybersecurity company Kaspersky who has studied APT40, said the group’s relentless pursuit of targets explains its success.

“While their techniques are not too sophisticated, their persistence makes up for it since all they need is one user to provide the access they are seeking,” Bartholomew told CyberScoop. “They tend to use very short-lived campaigns, which allows them to typically get in, get what they want, and leave before being detected.”

APT40 seems to have leaned on its signature malware for access to targets. Ben Read, senior manager of cyber-espionage analysis at FireEye, said that the malware had shown up in suspected APT40 operations from March 2019 through most of that year.

“While we cannot definitively attribute the activity in the report from Malaysia CERT, it is consistent with what we have seen from APT40,” Read told CyberScoop.

Bartholomew said that APT40 had made changes to that malware, known as DADJOKE, since he published research on the group in October. The group has also changed how it delivers its malicious code in an effort to compromise networks, he said.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure