Chinese Hackers

[kyonides]

Chinese hackers targeted U.S. political reporters just ahead of Jan. 6 attack

Hackers connected with the Chinese government engaged in numerous phishing campaigns targeting U.S.-based journalists since early 2021, with operations focused on political and national security reporters and White House correspondents in the days leading up to the Jan. 6 attack on the Capitol, researchers said Thursday.
...
Researchers with cybersecurity firm Proofpoint shared the details Thursday as part of a report looking at these kinds of operations carried out by China, Iran, North Korea and Turkey. The attacks both targeted journalists and had hackers posing as journalists to target others, the researchers said.
...
And posing as journalists allows hackers the ability to “spread disinformation or pro-state propaganda, provide disinformation during times of war or pandemic, or be used to influence a politically charged atmosphere,” the researchers added.
...
Cyberattacks on journalists and media organizations are nothing new. In 2013, The New York Times reported that Chinese hackers had been persistently attacking the paper over the course of several months in connection with reporting on then Chinese Prime Minister Wen Jiabao. In February of this year, The Wall Street Journal reported that hackers likely associated with China hacked and accessed emails and other documents of journalists and other employees in an intelligence collection effort.

And in November, the Department of Justice alleged that two Iranian hackers accessed the computer network of a media company with aims to modify content on news organizations’ websites as part of a sprawling election interference operation.

 How did they do it?

Chinese hackers associated with what are believed to be two distinct campaigns targeted U.S.-based journalists over the course of 2021 and into 2022, the researchers said. The first group, tracked by Proofpoint as TA412 but by Microsoft as Zirconium, used malicious emails with web beacons to collect information from targets’ systems spanning several months in early 2021.

The researchers identified five campaigns.
...
Emails sent to targets used subject lines pulled from recent articles, while the body of the email duplicated the text from those articles. Also included in the body was a PNG image file that connected to a hacker-controlled domain, a campaign identifier, victim identifier, campaign date and information about the image file.
...
A separate Chinese group, tracked by Proofpoint as TA459, targeted victims with a malicious document that, if opened, installed and executed Chinoxy malware. The malware gives an attacker a backdoor to a victim’s computer and allows them to maintain persistence, the researchers said.

The article above also mentioned  hacking groups based in North Korea, Turkey and Iran.  What a long list of bad guys indeed!