Quote:China’s communist regime is engaged in a worldwide campaign of cybercrime and leading experts believe that the United States is failing to respond swiftly enough to counter the threat.
“In the current era of cyber, it’s all about speed,” retired Army Col. John Mills told The Epoch Times.
“You have to presume a breach, and that the threat is inside. Looking at it from that perspective, it’s all about speed of identification, speed of ejection. The U.S. government is not good at that.”
All signs indicate that the Chinese Communist Party (CCP) and its proxies are engaged in a robust and global cybercrime campaign that aims to both destabilize the regime’s foes and position itself for a potential war with the United States.
“This is an extraordinary threat,” said Mr. Mills, who previously served as the director of Cybersecurity Policy, Strategy, and International Affairs at the Department of Defense.
A cache of leaked documents that surfaced in late February implicated the regime’s direct involvement in overseas cyber espionage.
The documents belonged to a criminal hacking group called I-Soon, which masquerades as a legitimate business in China, apparently with the regime’s blessing.
The leaked files revealed the group’s infiltration into government departments in India, South Korea, Thailand, Vietnam, and South Korea, as well as NATO organizations.
Files included product manuals, marketing materials, employee lists, chat records, financial information, and details about foreign infiltration efforts.
Some of the documents that were verified by the Associated Press show that the majority of the group’s clients are based within China’s regional security bureaus and the CCP’s Ministry of Public Security.
Mr. Mills said the revelation was “predictable,” and that CCP authorities have a long history of conducting illicit tasks in addition to their formal duties.
“The CCP and the government, which is one [and] the same thing, knew these people were moonlighting. This is part of the culture of corruption [in China],” Mr. Mills said.
The I-Soon leaks surfaced amid a wider flurry of CCP-backed cyber activity, in which the regime successfully infiltrated both U.S. critical infrastructure and the defense ministry of the Netherlands.
The documents belonged to a criminal hacking group called I-Soon, which masquerades as a legitimate business in China, apparently with the regime’s blessing.
The leaked files revealed the group’s infiltration into government departments in India, South Korea, Thailand, Vietnam, and South Korea, as well as NATO organizations.
Files included product manuals, marketing materials, employee lists, chat records, financial information, and details about foreign infiltration efforts.
Some of the documents that were verified by the Associated Press show that the majority of the group’s clients are based within China’s regional security bureaus and the CCP’s Ministry of Public Security.
Mr. Mills said the revelation was “predictable,” and that CCP authorities have a long history of conducting illicit tasks in addition to their formal duties.
“The CCP and the government, which is one [and] the same thing, knew these people were moonlighting. This is part of the culture of corruption [in China],” Mr. Mills said.
The I-Soon leaks surfaced amid a wider flurry of CCP-backed cyber activity, in which the regime successfully infiltrated both U.S. critical infrastructure and the defense ministry of the Netherlands.
Casey Fleming, CEO of the risk advisory firm BlackOps Partners, said that the Volt Typhoon initiative was part of the CCP’s strategy of unrestricted warfare through which it aims to secure military advantage over the United States through non-military means.
“The CCP is hyper-focused on weakening the U.S. from all angles to win the war without fighting,” Mr. Fleming told The Epoch Times.
“This is what World War 3 looks like. It’s the speed of technology, the stealth of unrestricted warfare, and no rules.”
Chinese-Made Spying Tools
Same Article Wrote:The more recent I-Soon leaks also shed light on the tools Chinese cybercriminals are deploying to infiltrate, undermine, and exploit the regime’s rivals.
Its services included a tool for infiltrating users’ accounts on social media platform X, including the ability to access phone numbers, email accounts, personal messages, and real-time activity even if users have enabled two-factor authentication.
Likewise I-Soon sold access to a custom suite of remote-access Trojans—malware capable of infecting Android, IOS, and Windows devices—which could, at times, alter registry files and collect GPS data, contacts, media files, and real-time audio recordings of conversations.
The Android version of the Trojan also had the capability of dumping all messages stored in major Chinese apps including QQ, WeChat, and Momo.
Notably, the I-Soon documents also revealed the existence of portable devices for “attacking networks from the inside,” including options to embed the malware in cellphone batteries, power strips, and circuit boards.
Similar devices could be outfitted with special equipment for operatives working abroad to establish safe communication with mainland China.
Mr. Mills said the regime is exploiting its advantage in the manufacturing domain to achieve dominance in cyberspace. China-based hackers are using manufacturing vulnerabilities in how devices connect and share data with one another.
And by smuggling malware into the United States with Chinese-made goods, he said, such devices could be used to penetrate the United States’ most critical infrastructure, as the Volt Typhoon malware was designed to do.
...
“The Internet of Things and critical infrastructure—that is still a very porous, vulnerable area,” Mr. Mills said.
“There’s a lot of industrial control systems and critical infrastructure. There’s a lot of obscure software programs and languages that are just not well understood, and they don’t scale as far as being able to secure them,” he added. “It’s very tailored and customized, which is inefficient and expensive, and that’s the reality of critical infrastructure.”
There are some indications that the Biden administration is beginning to tackle the issue of China-origin technology.
The Commerce Department announced on Feb. 29 that it intends to investigate and propose rules regarding vehicles with CCP-made technology.
"For God has not destined us for wrath, but for obtaining salvation through our Lord Jesus Christ," 1 Thessalonians 5:9
Maranatha!
The Internet might be either your friend or enemy. It just depends on whether or not she has a bad hair day.
Quote:New Zealand’s Government Communications Security Bureau (GCSB) revealed on Monday that Chinese state-sponsored hackers attacked two computer systems used by the New Zealand Parliament in 2021.
GCSB said the hackers managed to access some data on the systems, but nothing of a “strategic or sensitive” nature.
The GCSB is New Zealand’s leading cybersecurity and signals intelligence organization. The agency revealed previously classified details of the 2021 Chinese cyberattack after sister agencies in the United States and United Kingdom disclosed details of similar attacks they have endured.
“This is the first time we have attributed state-sponsored malicious cyber activity to the People’s Republic of China, for intrusion into New Zealand government systems,” GCSB Director Andrew Clark said on Monday.
Clark explained that his agency detected malicious activity in two key computer networks used by Parliament in August 2021. GCSB linked the intrusion to China’s Ministry of State Security (MSS) and one of its many hacker groups, code-named APT40, with a high degree of confidence.
“This link has been reinforced by analysis from international partners of similar events in their own jurisdictions,” Clark said.
APT40 is classified as a Chinese state-linked hacker threat by the U.S. Cybersecurity and Infrastructure Security Agency (CISA). The group operates under various colorful aliases, including Bronze Mohawk, GreenCrash, and Kryptonite Panda.
APT40 has been active since at least 2009, targeting government, corporate, and academic computer systems in the U.S., Canada, Europe, the Middle East, and the South China Sea region. The group has a predilection for attacking industries that might compete with China’s Belt and Road Initiative (BRI). The U.S. Department of Justice (DOJ) indicted four members of APT40 for cyber espionage in July 2021.
The 2021 New Zealand intrusion was described in detail in a statement released by GCSB minister Judith Collins, who condemned China for targeting New Zealand’s Parliament and the UK Electoral Commission with “malicious cyber activity.”
The government of New Zealand summoned Chinese Ambassador Wang Xiaolong to lodge a complaint and ask China to desist from such cyber-espionage in the future. However, New Zealand stopped short of leveling punitive sanctions against Beijing.
“Foreign interference of this nature is unacceptable, and we have urged China to refrain from such activity in future,” said Foreign Minister Winston Peters.
"For God has not destined us for wrath, but for obtaining salvation through our Lord Jesus Christ," 1 Thessalonians 5:9
Maranatha!
The Internet might be either your friend or enemy. It just depends on whether or not she has a bad hair day.
Quote:American and British officials on Monday [25th] announced criminal charges and punitive sanctions against a Chinese state-sponsored hacking group accused of victimizing millions of people in both countries over the past 14 years.
Prosecutors in the Eastern District of New York named the defendants as Ni Gaobin, Weng Ming, Cheng Fent, Peng Yaowen, Sun Xiaohui, Xiong Wang, and Zhao Guangzong. All are Chinese nationals working for China’s Ministry of State Security (MSS) as part of a cyber threat group dubbed APT31, also known by the alias Zirconium.
APT31 became active sometime around 2010, engaging in a wide range of illegal activity, usually linked to geopolitical events of interest to the Chinese government. For example, APT31’s malicious activity surged during the 2019 Hong Kong pro-democracy protests.
To date, the group has pumped out more than 10,000 malicious emails, targeting victims on several continents. Targets included government officials and their staffers, defense contractors, reporters, academics, and Chinese political dissidents.
Many of the virus-infested emails sent to Western politicians by the Chinese hackers were made to resemble legitimate messages from journalists. The U.S. indictment said APT31 gained illicit access to the records of millions of Americans by compromising thousands of government and corporate email and storage accounts.
The U.S. Treasury Department on Monday sanctioned Wuhan Xiaoruizhi Science and Technology Co., Ltd. (Wuhan XRZ), a front company operated by the MSS to cover the activities of the APT31 hackers.
“The Justice Department will not tolerate efforts by the Chinese government to intimidate Americans who serve the public, silence the dissidents who are protected by American laws, or steal from American businesses,” Attorney General Merrick Garland said on Monday.
“These allegations pull back the curtain on China’s vast illegal hacking operation that targeted sensitive data from U.S. elected and government officials, journalists and academics; valuable information from American companies; and political dissidents in America and abroad. Their sinister scheme victimized thousands of people and entities across the world, and lasted for well over a decade,” said U.S. Attorney for the Eastern District of New York Breon Peace.
“These defendants were part of a Chinese government sponsored hacking group, targeting U.S. businesses and U.S. political officials for intrusion for over a decade as part of a larger, malicious global campaign. These charges are yet another example of hostile actions taken by the PRC to attack not only American businesses and infrastructure, but the security of our nation,” said FBI Assistant Director-in-Charge James Smith of the New York field office.
In the United Kingdom, APT31 perpetrated a major cyberattack that stole the voter registration data of tens of millions of British citizens and attempted to hack the email accounts of members of Parliament. The hackers do not appear to have taken any action with the stolen voter registration data, raising suspicions that the hack was just a dry run, testing the defenses of Britain’s election system.
“This is the latest in a clear pattern of hostile activity originating in China. Part of our defense is calling out this behavior,” Deputy Prime Minister Oliver Dowden said on Monday.
The leftist New York Times (NYT) contrasted the aggressive and unified response by U.S. and British officials on Monday to the Obama administration’s extreme reluctance to name China as the culprit behind the Office of Personnel Management (OPM) hack in 2015, also known as “Cyber Pearl Harbor” – arguably the most damaging data breach in the brief history of the Internet.
"For God has not destined us for wrath, but for obtaining salvation through our Lord Jesus Christ," 1 Thessalonians 5:9
Maranatha!
The Internet might be either your friend or enemy. It just depends on whether or not she has a bad hair day.
Quote:FBI director Chris Wray said at a security conference on Thursday that China’s legion of state-sponsored hackers “considers every sector that makes our society run as fair game in its bid to dominate on the world stage.”
Wray said China’s plan is to “land low blows against civilian infrastructure to try to induce panic and break America’s will to resist.”
The FBI director was speaking at security conference called “Summit on Modern Conflict and Emerging Threats,” hosted by Vanderbilt University in Nashville. The 2024 edition of the summit was focused on “challenges China poses to the United States,” ranging from China’s dominance of critical supply chains to the fentanyl epidemic and cyberwar.
Wray called the audience’s attention to Volt Typhoon, the massive hacking operation linked to the People’s Republic of China (PRC) that penetrated an alarming number of critical infrastructure systems in the U.S., including water, power, oil, and transportation.
Volt Typhoon was detected and exposed by Microsoft cybersecurity technicians in May 2023. Microsoft said China’s state-sponsored hackers sought to develop “capabilities that could disrupt critical communications infrastructure between the United States and Asia region during future crises.”
Wray noted that China-sponsored hackers were “pre-positioned for potential cyberattacks against U.S. oil and natural gas companies way back in 2011.”
“When one victim company set up a honeypot – essentially, a trap designed to look like a legitimate part of a computer network with decoy documents – it took the hackers all of 15 minutes to steal data related to the control and monitoring systems,” he recalled.
Wray pointed out that in that incident, the hackers ignored “financial and business-related information,” which suggests “their goals were even more sinister than stealing a leg up economically.”
Honeypot systems are usually hardened to make cracking their core software extremely difficult, but the designers then camouflage the system to look much more vulnerable than it really is. A honeypot is a setup, and its administrators know they will be invaded, so for the invaders to quickly defeat the trap and penetrate the security of the rigged system is a remarkable achievement.
Volt Typhoon was a menacing example of a hacking technique known as “living off the land,” in which the hackers penetrate systems, deposit malware payloads, and then conceal their presence by exploiting and imitating normal system functions. The approach could be compared to a thief who takes a job as a bank teller and quietly works there for years before finally deciding to rob the bank.
“Living off the land” is an alarming tactic because most private hacker groups would not bother to hide for years after penetrating a system. Hackers are usually motivated to steal, vandalize, or hijack a system fairly soon after they gain entry, worried that their presence could be detected or their access to the system might be cut. They are typically eager to steal data for fun or profit.
As Wray explained at the Vanderbilt seminar, the major reason a group of highly skilled and coordinated hackers would lurk in a system for years is because they are planning massive acts of sabotage and waiting for their government handlers to tell them when the time is right to strike.
Wray said the Chinese Communist Party is driven by “aspirations to wealth and power,” which it hopes to realize by seizing control of “economic development in the areas most critical to tomorrow’s economy.”
Other speakers at the seminar highlighted Volt Typhoon as a new and dangerous type of cyberwar menace, including Gen. Timothy Haugh, head of the National Security Agency (NSA) and U.S. Cyber Command.
“What you see in Volt Typhoon is an example of how China has approached establishing access to put things under threat. There is not a valid intelligence reason to be looking at a water treatment plant from a cyber perspective,” he pointed out.
Haugh warned that Volt Typhoon sent “a pretty loud signal” about how China plans to “use cyberspace in a crisis,” such as a confrontation with the U.S. over Taiwan. He strongly recommended listening to that signal.
"For God has not destined us for wrath, but for obtaining salvation through our Lord Jesus Christ," 1 Thessalonians 5:9
Maranatha!
The Internet might be either your friend or enemy. It just depends on whether or not she has a bad hair day.
Quote:Communist China is suspected of being behind a major hack of Britain’s Ministry of Defence in which over a quarter of a million military service personnel may have had their private details compromised.
All of Britain’s armed forces servicemen and women, including active members as well as reservists and veterans, amounting to an estimated 270,000 people may have been compromised in a hack of the Ministry of Defence’s payroll.
The MoD has established a crisis response unit over the past three days after the suspected hack. Although the government has yet to formally accuse Communist China, multiple media outlets, including Sky News, have cited government sources claiming that Beijing is believed to be behind the cyberattack.
According to The Sun, Britain’s largest-circulation newspaper, the MoD also plans to hire contractors to scan the dark web to monitor if any information contained in the hack begins appearing for sale.
Former chairman of the defence select committee, Conservative MP Tobias Ellwood suggested that the information gleaned could enable the communist country to exert pressure on members of the military to give up secrets in exchange for “financial gain — perhaps even unaware China sits behind this”.
For its part, the Chinese foreign ministry denied involvement, saying that Beijing “firmly opposes and fights all forms of cyber attacks” and “rejects the use of this issue politically to smear other countries”. This claim would be remarkable if true, given the frequency with which European governments accuse China and its agents of attempting to hack their computer databases.
The suspected Chinese hack comes just weeks after the British government publicly accused Beijing of the 2021 hack on the UK’s Electoral Commission, which reportedly compromised the personal details of up to 40 million voters in the country. The UK also claimed that China was behind “attempted reconnaissance activity” on four parliamentary accounts in a separate 2021 incident.
Former Tory leader and co-founder of the Inter-Parliamentary Alliance on China (IPAC) Sir Iain Duncan Smith, who has been personally sanctioned by China, told Sky News: “This is yet another example of why the UK government must admit that China poses a systemic threat to the UK and change the integrated review to reflect that.
“No more pretence, it is a malign actor, supporting Russia with money and military equipment, working with Iran and North Korea in a new axis of totalitarian states.”
Executive Director of IPAC Luke de Pulford added: “This has to represent a turning point. These are actions suited to hybrid warfare, not the ‘mutual respect’ of which Beijing and London regularly boast.
“China under Xi Jinping is not a friend. Remove the blinkers. Our China strategy has failed. We need some realism fast.”
Despite the accusations of major hacks in Britain as well as the human rights violations in mainland China and the former British colony of Hong Kong, Prime Minister Rishi Sunak has refused to officially label the communist country a “threat” to the UK.
Sunak, who has long argued for closer trade ties with Beijing, has come under criticism for his ties to China, with the business of his wife’s family, Indian tech-giant Infosys, having significant operations within China.
"For God has not destined us for wrath, but for obtaining salvation through our Lord Jesus Christ," 1 Thessalonians 5:9
Maranatha!
The Internet might be either your friend or enemy. It just depends on whether or not she has a bad hair day.
Quote:Sen. J.D. Vance (R-OH) on Friday sent a letter to a cybersecurity agency concerning vulnerabilities in critical American infrastructure and how the agency is responding to the Chinese government-sponsored state hacking group Volt Typhoon.
Vance wrote his letter, which Breitbart News obtained, to Cybersecurity & Infrastructure Security Agency (CISA) Director Jen Easterly about how critical American infrastructure is “under attack” from the Chinese government “state-sponsored hacker group known as Volt Typhoon.” The Ohio senator said that the consequences of a Volt Typhoon attack on American infrastructure could be immense:
The impact from a full-scale Volt Typhoon attack on U.S. critical infrastructure would be devastating and could result in our nation being thrown into disarray at the exact time it is under military attack from foreign adversaries. The consequences of a Volt Typhoon attack would presumably include a threat to the U.S. military by disrupting power and water to our military facilities and critical supply chains.
...
Vance noted that Volt Typhoon has “compromised hundreds of thousands of devices since it was first publicly identified by Microsoft in May 2023.” In June 2023, the National Security Agency (NSA), CISA, FBI, and other international cybersecurity agencies issued a Cybersecurity Advisory (CSA) about Volt Typhoon’s capacity to attack critical infrastructure. In March 2024, CISA issued an advisory on best practices to harden its systems against Volt Typhoon.
Rob Ames, a staff threat researcher at SecurityScorecard, explained that Volt Typhoon typically uses more “hands-on keyboard techniques” than traditionally relying on activity exploited by malware.
“Critical infrastructure” sectors are particularly vulnerable to Volt Typhoon hacking. These sectors, which include communications systems, energy production, and government facilities, are “considered so vital to the United States that their incapacitation or destruction would have a debilitating effect on security, national economic security, national public health or safety, or any combination thereof.”
Vance wrote about the threat that is Volt Typhoon:
Indeed, experts believe the group has targeted U.S. critical infrastructure since mid-2021 using malicious software that penetrates internet connected systems. On January 31, 2024, the FBI reported that it had disrupted some of Volt Typhoon’s operations by removing the group’s malware from some small office routers.
However, on February 7, 2024, CISA, the FBI, and other U.S. agencies along with the Five Eyes partners released a major advisory in which they warned that Volt Typhoon was pre-positioning on critical infrastructure networks to “enable disruption or destruction of critical services in the event of increased geopolitical tensions.”
To better understand the risk that is Volt Typhoon, Vance asked that Easterly provide answers to these questions:
1. What is CISA’s understanding of how Volt Typhoon became embedded in U.S. critical infrastructure?
2. What prompted CISA to go public earlier this year warning of the urgent risk posed by Volt Typhoon?
3. How many U.S. public or private critical infrastructure entities in the Communications, Energy, Transportation Systems, and Water and Wastewater Systems sectors are impacted by Volt Typhoon?
4. Are there other critical infrastructure sectors impacted by Volt Typhoon? If so, which sectors (beyond those named in response to question 3)?
5. According to reports, CISA has worked with sector risk management agencies to do outreach to each sector regarding Volt Typhoon. Which agencies specifically?
6. Which Information Sharing and Analysis Centers (ISACs) are aware of Volt Typhoon?
7. How many individual network devices in the U.S. are impacted or potentially impacted by Volt Typhoon?
8. What strategies have CISA and/or sector risk management agencies named in response to question 5 designed and/or implemented to mitigate the threat from Volt Typhoon?
9. How many calls to CISA’s 24/7 Operations Center regarding Volt Typhoon has the agency received since January 1, 2023?
American officials’ concerns became so immense that Nathaniel Fick, the State Department’s ambassador-at-large for cyberspace and digital policy, said in May that American and Chinese officials discussed the Volt Typhoon espionage campaign that targeted American critical infrastructure.
...
"For God has not destined us for wrath, but for obtaining salvation through our Lord Jesus Christ," 1 Thessalonians 5:9
Maranatha!
The Internet might be either your friend or enemy. It just depends on whether or not she has a bad hair day.
Quote:Microsoft President Brad Smith acknowledged the company’s role in major security breaches that allowed China-linked hackers to infiltrate federal government computer networks in a Congressional hearing this week. The executive also defended the company’s operations in the communist dictatorship.
CNBC reports that during his testimony before the House Homeland Security Committee, Smith struck a contrite tone, promising that the tech giant would address the security gaps in its products, which are widely used across federal agencies. However, Republican lawmakers shifted their focus to Microsoft’s activities in China, questioning the company’s ability to enhance its cybersecurity while operating in a country where the government demands access to data from businesses and other organizations by law.
Smith claimed that Microsoft’s data centers and cloud services in China primarily serve American and other non-Chinese corporations, helping to protect their trade secrets. He also noted that Microsoft’s business in China accounts for only 1.4 percent to 1.5 percent of the company’s total revenue. When pressed by Rep. Carlos Gimenez (R-FL) about whether it was worth operating in China, Smith maintained that Microsoft does not comply with a 2017 Chinese national intelligence law requiring firms to hand over information requested by the government, and has refused some requests from Beijing, although he did not provide specific details.
The hearing was organized in response to a scathing government report in April, which found “a cascade of errors” by Microsoft that allowed state-backed Chinese hackers to breach email accounts used by government employees and senior officials, including the email of Commerce Secretary Gina Raimondo. The report, issued by the Cyber Safety Review Board, concluded that the breach was “preventable” and criticized Microsoft’s corporate culture for deprioritizing enterprise security investments and rigorous risk management.
Smith assured lawmakers that Microsoft fully accepted the report’s findings and is implementing its recommendations. The company has deployed approximately 34,000 engineers to focus on security, which Smith described as “the single largest cybersecurity engineering project in the history of digital technology.” He acknowledged that while Microsoft had not lost sight of the importance of security, much of the workforce had become overly reliant on a large team of security experts to address potential cyberthreats, rather than viewing it as a collective responsibility.
"For God has not destined us for wrath, but for obtaining salvation through our Lord Jesus Christ," 1 Thessalonians 5:9
Maranatha!
The Internet might be either your friend or enemy. It just depends on whether or not she has a bad hair day.
Quote:A cybersecurity team called the Insikt Group published a report on Monday that found Chinese state-sponsored hackers have significantly intensified attacks on Taiwan, seemingly with an eye toward stealing Taiwanese technology and spying on Taiwan’s diplomatic initiatives.
The Insikt Group is the threat research division of Recorded Future, an international cybersecurity firm with both government and corporate clients spread across 75 countries.
The group’s report focused on “RedJuliett,” a cyber-espionage group believed to be sponsored by the Chinese government. RedJuliett’s activities were detected for the first time in August 2023, when Microsoft discovered a sizable cyber-espionage campaign targeting companies in Taiwan.
Microsoft dubbed the hacking threat “Flax Typhoon,” while cybersecurity firm CrowdStrike detected its activities at roughly the same time and named it “Ethereal Panda.” Insikt Group researchers were confident that all of these designations were names for the same cybersecurity threat actor.
The group pulled off some cyberattacks against other countries, including South Korea and the United States, but about 60 percent of its detected activity has been focused on Taiwan. RedJuliett’s activity has been traced back to the Chinese city of Fuzhou, which is close to Taiwan and hosts numerous Chinese intelligence operations targeting the island.
“While RedJuliett’s potential affiliation with either China’s Ministry of State Security MSS or People’s Liberation Army PLA is currently unknown, an operating location within Fuzhou is consistent with the group’s persistent focus on Taiwan,” the report said.
The Insikt Group found RedJuliett’s espionage activities against Taiwan between November 2023 and April 2024, hitting “over 70 academic, government, think tank, and technology organizations in Taiwan, as well as multiple de facto embassies operating on the island.”
Taiwan often lacks official embassies from other countries due to China’s political pressure. The de facto American embassy, for example, is an organization called the American Institute in Taiwan (AIT).
The cybersecurity report said:
Within Taiwan, we observed RedJuliett heavily target the technology industry, including organizations in critical technology fields. RedJuliett conducted vulnerability scanning or attempted exploitation against a semiconductor company and two Taiwanese aerospace companies that have contracts with the Taiwanese military.
Taiwan’s presidential election season began around the same time as RedJuliett’s increased activity, culminating in the election of William Lai Ching-te as the successor to President Tsai Ing-wen in January 2024. Lai was inaugurated in May 2024. He belongs to the same Democratic Progressive Party (DPP) as Tsai, so his victory marked the first time in the history of Taiwan’s democracy that the same party held the presidency for three consecutive terms.
The communist Chinese government hates both Tsai and Lai, dubbing them “separatists” and “insurrectionists.” Beijing deployed what Lai denounced as an “unprecedented” level of election interference to intimidate Taiwanese out of voting for him.
“In addition to political and military pressure, it is also using economic means, cognitive warfare, disinformation, threats and incentives. It has resorted to all means to interfere with this election,” Lai said in January.
The Insikt Group said it could not determine how successful RedJuliett’s cyberattacks were, as it could observe the attempts from outside of targeted networks but could not see the results.
RedJuliett had an arsenal of sophisticated hacking tools at its disposal, including code that exploited vulnerabilities in networks, web servers, and security software. The group employed “living off the land” (LotL) techniques, a disturbing new trend in cyber espionage in which hackers penetrate a system, hide their malicious code among the many legitimate programs running on a large network, and remain dormant for long periods.
LotL tactics are alarming to cybersecurity researchers because they suggest the hackers are lying in wait for some anticipated signal — like a declaration of war by the country that sponsors them — rather than causing damage or stealing data immediately.
Of course, the CCP strongly denied any involvement in the cyberattacks.
"For God has not destined us for wrath, but for obtaining salvation through our Lord Jesus Christ," 1 Thessalonians 5:9
Maranatha!
The Internet might be either your friend or enemy. It just depends on whether or not she has a bad hair day.
Quote:A Chinese Communist Party (CCP) spy group has been hacking public and private networks, according to federal intelligence agencies from the Five Eyes’ nations.
The Federal Bureau of Investigation, along with sister agencies like the Australian Signals Directorate (ASD), revealed that a group known as APT40 had been behind the historical and ongoing hacks.
The CCP Ministry of State Security backs the group and uses a sophisticated system to make detection difficult.
“APT40 is actively conducting regular reconnaissance against networks of interest in Australia, looking for opportunities to compromise its targets,” the ASD said in a statement.
“The group uses compromised devices, including small-office/home-office (SOHO) devices, to launch attacks that blend in with legitimate traffic, challenging network defenders,” it continued.
“APT40 continues to find success exploiting vulnerabilities in end-of-life or no longer maintained devices on networks of interest and systems that are poorly maintained and unpatched.”
A Chinese Communist Party (CCP) spy group has been hacking public and private networks, according to federal intelligence agencies from the Five Eyes’ nations.
The Federal Bureau of Investigation, along with sister agencies like the Australian Signals Directorate (ASD), revealed that a group known as APT40 had been behind the historical and ongoing hacks.
The CCP Ministry of State Security backs the group and uses a sophisticated system to make detection difficult.
“APT40 is actively conducting regular reconnaissance against networks of interest in Australia, looking for opportunities to compromise its targets,” the ASD said in a statement.
“The group uses compromised devices, including small-office/home-office (SOHO) devices, to launch attacks that blend in with legitimate traffic, challenging network defenders,” it continued.
“APT40 continues to find success exploiting vulnerabilities in end-of-life or no longer maintained devices on networks of interest and systems that are poorly maintained and unpatched.”
Australia Invests Billions in Secure Cloud Technology
Australia’s Defence Minister Richard Marles praised the work of the ASD in attributing the threat, and said this was an important part of deterrence.
His comments come days after the government announced a $2 billion (US$1.35 billion) top secret cloud computing program for intelligence agencies, to be developed in partnership with Amazon Web Services Australia.
“Modern defence forces and indeed modern conflict is more reliant upon information technology, upon computing infrastructure, than ever before,” he said.
“And in turn what that means, is that increasingly, modern conflict is occurring at a top-secret level and so this capability, in terms of computing infrastructure, will ensure that Australia maintains at-pace with the leading defence forces in the world,” he added.
“It will ensure that we have a far more resilient capable, lethal, modern and potent defence force for the future.”
The Top Secret (TS) Cloud will be purpose-built for Australia’s defence and national intelligence community agencies to securely host the country’s most sensitive information, and development new technologies.
You may also want to know that back in May 2024 the CCP also made an attempt to cyber-infiltrate the offices of Canadian parliamentarians. So this definitely is a highly important issue for the members of the Five Eyes alliance.
Quote:MPs agreed unanimously on May 9 to investigate China’s cyberattacks against parliamentarians through a House of Commons committee.
The motion for the investigation was initiated by Conservative MP Garnett Genuis, who raised a question of privilege on April 29. He revealed that day that he and 17 other parliamentarians were targeted in 2021 by a Beijing-backed hacker group known as Advanced Persistent Threat 31 (APT31).
The cyberattack on Canadian parliamentarians was part of APT31’s broader hacking campaign against members of the Inter-Parliamentary Alliance on China (IPAC), Mr. Genuis told the House of Commons on April 29. IPAC is an international group of cross-party legislators working to more effectively tackle the threat of Beijing.
The APT31 attacks gained public attention after the U.S. Department of Justice unsealed an indictment on March 25, charging seven Chinese nationals linked to the hacker group. The indictment revealed that the group had spent approximately 14 years targeting critics of the Chinese regime, both in the U.S. and abroad, as well as businesses and political figures, with the goal of furthering Beijing’s economic espionage and foreign intelligence objectives.
Mr. Genuis, along with Liberal MP John McKay, also a co-chair of IPAC, raised concerns in an April 29 statement. They noted that despite warnings from U.S. intelligence authorities about APT31’s attacks dating back to 2022, the Canadian government did not inform the affected parliamentarians of the threat.
“Canadian legislators should have been informed as soon as possible, especially given the progressive nature of this attack,” the MPs wrote. “Steps should be taken to ensure legislators are informed of attacks or potential attacks against them in the future, and to sanction those responsible for this attack.”
On May 8, House Speaker Greg Fergus ruled that Mr. Genuis’s concern constituted a question of privilege. This privilege allows MPs to raise concerns about their parliamentary work being obstructed, prompting immediate consideration in the House of Commons. Mr. Genuis’s motion, now adopted, will be investigated by the House of Commons Standing Committee on Procedure and House Affairs.
Mr. Fergus pointed out that Mr. Genuis compared his situation to the question of privilege involving former Chinese consulate officer Wei Zhao’s intimidation campaign against Tory MP Michael Chong.
Targeting Personal Email
In an April 30 statement to The Epoch Times, Mathieu Gravel, spokesperson for the House of Commons Speaker’s Office, said the administration had “determined that the risk-mitigation measures in place had successfully prevented any attack,” adding that “There were no cybersecurity impacts to any Members or their communications.”
Mr. Genuis has disputed the claim that parliamentarians were unaffected, pointing out that his personal email was targeted. He told The Epoch Times that he received this information from IPAC and that is was collected by the FBI.
“Parliamentarians still need to know about targeted threats against them, even when those threats do not succeed. If someone tries to hurt me but their attempts are thwarted, I would still like to know I have been targeted in order to plan to protect myself going forward,” he said in the House of Commons on May 1.
“Moreover, your office is not at all able to say that these attacks were thwarted, because they evidently targeted members on both parliamentary and non-parliamentary emails.”
"For God has not destined us for wrath, but for obtaining salvation through our Lord Jesus Christ," 1 Thessalonians 5:9
Maranatha!
The Internet might be either your friend or enemy. It just depends on whether or not she has a bad hair day.
Quote:The DOJ says China’s TikTok sent very personal U.S. user data to the Chinese Community Party, and allowed the app’s users to be profiled based on their attitudes towards topics like gun control and abortion.
In a new filing, the DOJ notes that TikTok employees communicate internally with one another using a tool called Lark, and claimed that “significant amounts of restricted US user data (including but not limited to personally identifiable information)” was shared on this platform, according to a report by the Register.
“This resulted in certain sensitive U.S. person data being contained in Lark channels and, therefore, stored on Chinese servers and accessible to ByteDance employees located in China,” the DOJ continues in its filing.
To make matters worse, the DOJ goes on to allege that “Lark contained multiple internal search tools that had been developed and run by China-based ByteDance engineers for scraping TikTok user data, including U.S. user data.”
Those tools allowed for Chinese communists to collect and view “bulk user information based on the user’s content or expressions, including views on gun control, abortion, and religion,” the filing states.
The DOJ also claims that TikTok tools allow for “triggering of the suppression of content on the platform based on the user’s use of certain words. Although this tool contained certain policies that only applied to users based in China, others such policies may have been used to apply to TikTok users outside of China.”
Moreover, tech giant Oracle is also mentioned in the filing. As Breitbart News reported, despite the U.S. government’s efforts to prevent advanced AI chips from falling into the hands of the Chinese, some American companies are finding ways to circumvent these restrictions — Oracle being one avenue for this.
Oracle in particular has helped China’s TikTok by “renting” AI chips to the communist social media company.
Notably, Oracle being tasking with overseeing TikTok’s source code was also rejected due to the total volume of the codebase involving a review that would take at least three years to complete.
“But the source code is not static,” the DOJ filing states. “ByteDance regularly updates it to add and modify TikTok’s features. Even with Oracle’s considerable resources, perfect review would be an impossibility.”
The DOJ went on to say that Oracle and other tech providers wouldn’t be able to know if they have enough information to do the job correctly.
“Private parties also lack insight into ByteDance’s communications with PRC officials, ByteDance’s use of U.S. user data, and ByteDance’s other TikTok-related activities,” the filing asserts.
Therefore, U.S. authorities “determined that the Final Proposed NSA presented too great a risk because the trusted technology provider and other monitors faced massive scope and scale hurdles that could not be overcome.”
Last month, the FTC informed the DOJ that the Chinese app may be in violation of U.S. law on child privacy, saying that it has investigated TikTok and its Chinese parent company ByteDance, and “uncovered reason to believe” the companies are “violating or are about to violate” the Children’s Online Privacy Protection Act.
These cases are separate from the recently passed sell-or-ban legislation that calls on ByteDance, which is beholden to the Chinese Communist Party, to sell TikTok by January or else face a ban in the United States.
As Breitbart News reported, the move to ban TikTok unless ByteDance sells the app comes after years of concern over Chinese communists running a popular social media platform that has proven itself to be a danger for kids and teens, and whose parent company has already been caught snooping on journalists.
TikTok is also facing multiple lawsuits brought by several mourning families who say the Chinese social media platform is directly responsible for the deaths of their children.
Additionally, TikTok is widely considered a national security threat by lawmakers on both sides of the aisle, with lawmakers already having banned the Chinese app from U.S. government devices.
"For God has not destined us for wrath, but for obtaining salvation through our Lord Jesus Christ," 1 Thessalonians 5:9
Maranatha!
The Internet might be either your friend or enemy. It just depends on whether or not she has a bad hair day.
Chinese Hackers
![[Image: SP1-Scripter.png]](https://www.save-point.org/images/userbars/SP1-Scripter.png)
![[Image: SP1-Writer.png]](https://www.save-point.org/images/userbars/SP1-Writer.png)
![[Image: SP1-Poet.png]](https://www.save-point.org/images/userbars/SP1-Poet.png)
![[Image: SP1-PixelArtist.png]](https://www.save-point.org/images/userbars/SP1-PixelArtist.png)
![[Image: SP1-Reporter.png]](https://i.postimg.cc/GmxWbHyL/SP1-Reporter.png)
Of course, the CCP strongly denied any involvement in the cyberattacks.