Chinese Hackers

[kyonides]

UEFI and Chinese Operatives

https://www.cyberscoop.com/kaspersky-uef...nts-china/

The crucial computing code that manages that booting process, known as UEFI firmware, represents a valuable target for hackers, though also one that remains difficult to infiltrate.
Researchers from security company Kaspersky on Monday revealed what they described as the second case of malicious UEFI firmware found in use in the wild. Security specialists found UEFI implants that appeared to be part of a larger hacking operation carried out by Chinese-speaking operatives against diplomatic organizations and non-governmental organizations in Africa, Asia and Europe.

These events took place from 2017 to 2019, in an attempt to gather information on North Korea or the targets working there like two diplomatics.
According to Kaspersky, parts of the code are based on the Italian HackingTeam's UEFI hacking tool.
Experts think UEFI implants might become even more common every day that passes.

Front Companies as Disguise for State Sponsored Hackers

https://www.cyberscoop.com/chinese-irani...companies/
Some time ago we reported the indictment of several Chinese and Malaysian citizens. Now authorities released more information pertaining their actual affiliation.

The Justice Department on Sept. 16 unsealed an indictment against five Chinese men and two Malaysian nationals for their alleged role in a years-long spying scheme that infected software including Asus, CCleaner and Netsarang with malware.
Some suspects working as part of the larger operation functioned as part of Chengdu 404, which marketed itself as a penetration testing company with a “patriotic spirit.”

But why would they do such a weird thing? Here's the answer to that question!

Intelligence analysts contend the Chinese government began outsourcing cyber-espionage work to nondescript companies after a 2014 agreement in which the U.S. and China agreed to not sponsor any malicious cyber activity for economic gain.
“The APT landscape in China is run in a ‘whole country’ approach, leveraging skills from universities, individual, and private and public sectors,” researcher Timo Steffens said. “So some of the smaller companies might just be a way for individual hackers to band together and be eligible for government contracts.”

The article also reminds us of Rana, an Iranian hacking group, and how it used similar tactics to recruit and organize their hackers.