Chinese Hackers

[kyonides]

Why Chinese hackers have unleashed cyberattacks on 'friend Russia' since Ukraine conflict, what 'war secrets' are behind these attacks

Cyber analysts have reportedly discovered a strange cyberwarfare trend. According to a report by New York Times, quoting security researchers, since the beginning of the war in Ukraine, groups linked to the Chinese government have repeatedly hacked Russian companies and government agencies in an apparent search for military secrets. There has been increase in Since Russia’s invasion of Ukraine in February 2022, Chinese government-linked hackers have repeatedly targeted Russian companies and government agencies, seeking military secrets, according to the New York Times report.

The cyberattacks, which intensified in May 2022, have persisted despite public declarations of a “no-limits” partnership between Russian President Vladimir Putin and Chinese President Xi Jinping.

Chinese hacking groups 'targetting' Russian businesses

The report claims that a Chinese hacking group, Sanyo, impersonated a Russian engineering firm’s email addresses in 2023 to steal data on nuclear submarines, as uncovered by Taiwan-based cybersecurity firm TeamT5, which linked the attack to Beijing. “China likely seeks to gather intelligence on Russia’s activities, including on its military operation in Ukraine, defense developments and other geopolitical maneuvers,” TeamT5 researcher Che Chang told the Times.

A classified Russian FSB document, obtained by The New York Times, reveals Moscow’s concerns about China’s pursuit of Russian defense technology and battlefield insights, labeling China an “enemy.” This contrasts with the public Sino-Russian alliance, as Russia relies on China for oil markets and war-critical technology. The document highlights China’s interest in drone warfare and software, noting that “the war in Ukraine fundamentally shifted intelligence priorities for both countries,” according to Itay Cohen of Palo Alto Networks, as quoted by the Times.

What techniques Chinese hackers are said to be using against Russia

The New York Times also reports that Chinese hackers targeted Rostec, Russia’s state-owned defense conglomerate, for satellite communications and radar data, using malicious Microsoft Word files to infiltrate aviation and state entities. Groups like Mustang Panda, suspected of ties to China’s Ministry of State Security, have hit Russian military and border units, the Times notes, citing Rafe Pilling of Sophos. Pilling told the Times, “The targeting we’ve observed tends to be political and military intelligence gathering.”

Proprietary malware like Deed RAT, used by Chinese state-sponsored hackers, has been deployed against Russian aerospace and defense sectors, the report said, citing Positive Technologies. Despite 2009 and 2015 agreements barring mutual cyberattacks, the Times notes that experts view these as symbolic, with hacking spiking post-Ukraine invasion. “The activity — we saw it immediately in the months following Russia’s full-scale invasion,” Cohen told the Times, highlighting the tension beneath the public narrative of Sino-Russian unity.

Can you trust a country that does not care about its hackers hitting an ally's cyber-infrastructure as it did not matter at all?

FBI and Canadian cybersecurity agency warns: Chinese hackers attacking telecom services in Canada

Canada's cybersecurity agency, the Canadian Centre for Cyber Security, has issued a warning that Chinese-backed hackers are likely responsible for a recent attack that compromised telecommunications infrastructure in the country. The agency confirmed that three network devices registered to a Canadian company were compromised in these attacks. In a joint bulletin (as seen by Bloomberg) released this week with the US Federal Bureau of Investigation (FBI), the Canadian Centre for Cyber Security urged Canadian organisations to strengthen their networks against the threat posed by Salt Typhoon, a hacking group with documented links to the Chinese government. The warning emphasises the ongoing risk and the need for immediate action to protect critical infrastructure.

What Canada’s cybersecurity agency said about the recent hacking incident

“The Cyber Centre is aware of malicious cyber activities currently targeting Canadian telecommunications companies. The responsible actors are almost certainly PRC state-sponsored actors, specifically Salt Typhoon,”the agency said, referring to the People’s Republic of China, reports Bloomberg.
The agency also noted that separate investigations showing overlaps with indicators linked to Salt Typhoon indicate the cyber campaign “is broader than just the telecommunications sector.”

According to the agency, the hackers will “almost certainly” continue attempting to infiltrate Canadian organisations — particularly telecom providers — over the next two years, the report adds.

Beijing has consistently rejected US claims linking it to Salt Typhoon, a group first reported by The Wall Street Journal last year. In January, the US imposed sanctions on a Chinese company for allegedly being “directly involved” in the cyber intrusions, along with China’s Ministry of State Security.