A sophisticated hacking group targeted governments and corporations in Southeast Asia for a decade, marking one of the longest-running and most efficient campaigns unveiled, according to security company FireEye Inc.
Named APT30, the group increased hacking activity ahead of regional diplomatic meetings and also targeted at least 15 companies in communications, technology, finance and aviation, the U.S. cybersecurity provider said. Parts of India’s military were also targeted, it said.
FireEye, whose Mandiant division identified a sophisticated Chinese military hacking unit before the U.S. issued indictments against members of that group, said it didn’t have the evidence to prove China’s connection to APT30. Software code and language are among indicators the software used to manage the attacks was developed in China, FireEye said.
“Given the types of targets as well as how the victims were targeted and who the targets were, what was being sought was clearly relevant to Chinese national interests,” Bryce Boland, chief technology officer for Asia-Pacific at FireEye, said in an interview. “All indications point to the Chinese government, I just don’t have a smoking gun.”
Since at least 2005, APT30 distributed malicious software, known as malware, that then gave hackers access to computers among countries in the Association of Southeast Asian Nations and India, FireEye said in a report released today.
Cyber Victim
China’s foreign ministry, defense ministry and Internet regulator have repeatedly denied that the nation is behind any cyber attacks. Hua Chunying, a foreign ministry spokeswoman, told reporters on March 30 that the country is “one of the major victims” of cyber attacks.
China’s Cyberspace Administration Office didn’t immediately respond to faxed questions about the FireEye report.
According to University of Toronto researchers, China has begun using an “offensive system” able to disrupt access to websites outside its borders.
The deployment of this system represents a “significant escalation in state-level information control,” the university’s Citizen Lab said in a report posted to its website Friday. This system, dubbed the “Great Cannon,”, was used in recent attacks on GitHub Inc. and servers used by GreatFire.org, according to the university’s report.
Software Package
APT30 used a package of software, named Backspace and Neteagle, and related tools called Shipshape, Spaceship and Flashflood, to go after files from targets involved in political, military, and economic affairs, according to the FireEye report. Media organizations and journalists were also targeted, it said
Targeting of computers not directly connected to the Internet -- known as air-gapped networks -- showed the hackers were seeking the most-sensitive types of information and knew how to exploit USB thumb drives to steal files, Boland said. Its targeting of air-gapped systems since 2005 is one of the earliest observed examples of such a strategy, FireEye said.
“The attacks against the high-tech sector were quite focused on gaining access to schematics and design information for products,” Boland said, declining to name specific targets.
By sending e-mails that appeared to come from legitimate correspondents, including letters written fluently in local languages such as Thai, the hackers were able to trick targets into opening infected documents that installed malware.
Spear Phishing
In one instance, hackers sent an e-mail purporting to come from a trusted source -- known as spear phishing -- to more than 50 journalists with a subject line containing the phrase “China MFA Press Briefing,” FireEye said. MFA is an abbreviation for the Ministry of Foreign Affairs.
FireEye identified seven countries as confirmed targets, including India and the U.S. A further 10 nations were classified as “likely” targets.
The APT30 group used spear phishing techniques to seek information on military relations between China and India and contested regions, FireEye said.
Orderly updates of the malware and the keeping of detailed records of software versions indicate a large, efficient and tightly run group, FireEye said.
“We have observed APT30 target national governments, regionally-based companies in 10 industries, and members of the media who report on regional affairs and Chinese government issues,” FireEye said. “The group expresses a distinct interest in organizations and governments associated with ASEAN, particularly so around the time of official ASEAN meetings.”
APT30 released customized variants of its malware to coincide with ASEAN meetings in Jakarta, Phnom Penh and New Delhi, according to the report.
Bloomberg
Mon Apr 13 2015
A sophisticated hacking group targeted governments and corporations in Southeast Asia for a decade, a security company said.
AWANI Ringkas: Pembentangan Belanjawan 2025
Ikuti rangkuman berita utama yang menjadi tumpuan sepanjang hari di Astro AWANI menerusi AWANI Ringkas.
#AWANIRingkas 18 Oktober 2024 | 9 PM
Berikut merupakan rangkuman berita setakat 9 malam, 18 Oktober 2024
1️⃣ Pembentangan Belanjawan 2025
2️⃣ Sektor pendidikan
3️⃣ Sektor kesihatan
#awaniringkas
1️⃣ Pembentangan Belanjawan 2025
2️⃣ Sektor pendidikan
3️⃣ Sektor kesihatan
#awaniringkas
Belanjawan 2025: Peruntukan AI dinaikkan sebanyak RM50 juta
Kerajaan komited memperluaskan pendidikan berkaitan Kecerdasan Buatan (AI) ke semua universiti penyelidikan dengan peruntukan RM50 juta, berbanding RM20 juta tahun ini.
Latihan regata bertukar tragedi, lima peserta dikhuatiri lemas
Insiden melibatkan 15 peserta menggunakan satu bot untuk latihan regata. 10 individu berjaya selamatkan diri manakala lima yang lain masih hilang.
UAE hantar tiga lagi pesawat bersama 120 tan bantuan untuk Lubnan
UAE setakat ini telah menghantar 12 pesawat yang membawa 515 tan bekalan bantuan.
Belanjawan 2025: Nak masuk Universiti? Ini cara kerajaan bantu anda
Belanjawan MADANI memperlihatkan komitmen Kerajaan dalam meningkatkan sektor pendidikan tinggi negara.
Belanjawan 2025 sedia platform menyeluruh hadapi cabaran tahun depan - Mohamad Hasan
Langkah-langkah dalam Belanjawan 2025 juga dilihat cuba mengimbangi keperluan rakyat terutama dalam mendepani isu kos sara hidup.
Jumlah kematian di Lubnan terus meningkat
Jumlah kematian akibat serangan udara Israel di Lubnan sejak tercetusnya konflik Israel-Hizbullah pada 8 Oktober 2023 meningkat kepada 2,412.
Lima hilang selepas perahu lumba karam
Wartawan AWANI Borneo, Fadillah Sulaiman bawakan laporan terkini insiden perahu lumba karam dan tenggelam berhampiran kawasan perindustrian Bintawa.
Kematian Yahya Sinwar tidak sesekali patahkan semangat Hamas
Kematian itu dilihat bakal mempupuk semangat yang menebal dalam kalangan mereka untuk terus memperjuangkan agenda pembebasan Palestin yang merdeka sekali gus menamatkan agenda kekejaman rejim Zionis
Pembangunan digital ASEAN perlukan cybersecurity sebagai keutamaan yang tinggi - Gobind
Para pemimpinnya, yang bertanggungjawab untuk pembangunan Teknologi Maklumat dan Komunikasi (ICT) dan cybersecurity, perlu mempunyai perubahan set minda.
Cyberjaya jadi tuan rumah kepada Pusat Transparensi Kaspersky
Dapat kerjasama CyberSecurity Malaysia, sebuah agensi di bawah Kementerian Komunikasi dan Multimedia serta pakar-pakar keselamatan siber kebangsaan.
Microsoft, CyberSecurity mahu peruntukan untuk tingkat kesedaran keselamatan siber
CyberSecurity Malaysia dan Microsoft Malaysia mahu peruntukan untuk meningkatkan kesedaran mengenai keselamatan siber negara dan mendidik orang ramai di bawah Bajet 2018 memandangkan Malaysia kini ber
Serangan e-mel jadi pilihan utama penyerang siber di Malaysia pada 2016
Serangan e-mel merupakan senjata paling digemari para penyerang siber di Malaysia tahun lepas.
Penggodaman laman web MAS boleh dielak jika sistem sentiasa dipantau - CyberSecurity Malaysia
CyberSecurity Malaysia berkata penggodaman laman web MAS boleh dielakkan sekiranya sistemnya sentiasa dipantau dan diperbaharui.