Eight years after the Obama-Xi deal, Chinese hacking is worse than ever

SAN FRANCISCO Eight years ago, the U.S. and China reached a historic treaty agreement designed, in part, to end an ongoing deluge of cyberattacks targeting U.S. companies to steal their corporate secrets and intellectual property.

At the time, then-President Barack Obama commend The agreement, said at a joint news conference with Chinese President Xi Jinping, marks an agreement between the two countries that neither the U.S. nor the Chinese government will conduct or knowingly support the cyber theft of intellectual property, including trade secrets or other secrets Business information to gain a business advantage.

Eight years later, the sentiment is as old as warm milk.

Chinese hackers haven’t stopped targeting U.S. businesses, but they have become more aggressive and innovative in the years since, according to Google’s security experts.

“I’ll tell you that today’s investigation of an intrusion orchestrated by a Chinese threat actor has nothing to do with the investigation into the 2015 Obama/Xi The treaty agreement is very different from the invasion before the 2023 San Francisco conference.

Before the deal, hackers linked to China were widespread and not focused on the businesses they targeted. Today, a range of threat groups operating in China or working directly on Beijing’s behalf target valuable actors and specific industries with laser-like precision, including defense contractors, telecommunications companies, government agencies, and technology companies. Most of these industries tend to manage, own, or operate large amounts of IT infrastructure on behalf of hundreds, thousands, or millions of customers, which means they can provide potential avenues to infect downstream customers, just as Chinese hackers did in 2021 at Microsoft as was done in the Exchange attack.

Strategies and tactics of Chinese threat groups have changed since the 2015 agreement

These have also changed their strategies and tactics to increasingly target edge devices such as virtual private network (VPN) and other remote access solutions, firewall and hypervisor Has a zero-day vulnerability. Because these devices often don’t support newer security technologies like Endpoint Detection and Response (EDR), many companies simply don’t know they’re being compromised.

Carmakal said that every month Mandiant publishes at least one or two threat intelligence studies focused on vulnerabilities or exploits in edge devices. When researchers spot malicious traffic from a network device and request a hard drive image for further analysis, they contact the vendor. A lot of times, it’s easy for them to quickly identify that there’s very novel malware on those devices, and other people can’t find it because no one’s doing forensics on those devices.

What has been discovered is that these actors are deploying more malware on these devices that do not support EDR solutions such as VMware hypervisors, such as Fortinet firewalls, because it is difficult for companies to determine that there is actually a problem in these devices, that there are indeed Malware, said Kamakar.

Chinese hackers have also become better at hiding and diversifying the infrastructure they use to carry out their attacks, said John Hultquist, director of threat intelligence at Google Cloud Mandiant.

In the past, researchers have been able to trace Chinese attacks back to specific towns where the Office of Technical Reconnaissance, the intelligence agency that supports hacking, signals intelligence and other activities on behalf of the Chinese government, has made attribution a relatively straightforward endeavor.

Most groups now rely on proxy networks or route their activity through small home office SOHO routers, which allow them to better mask their presence and identity.

That really breaks your ability to track some of these things, because infrastructure is obviously a big part of your attribution and clustering. This is a true operational safety innovation, Hultquist said.

Malicious China Campaign Less Spam, More Focused

In 2015, ahead of the 2016 presidential election, the US was already being ridiculed for online disinformation and influence operations from countries like Russia. In the years since, China, Iran and other countries have launched similar campaigns targeting U.S. consumers.

One of the most prominent campaigns targeting the 2022 midterm elections, Mandiant and Google Threat Analysis Group (TAG) CALLED DRAGONBRIDGE Aims to discredit the US political system and sow division among its allies. While Mandiant assesses with a high degree of confidence that DRAGONBRIDGE’s goals are ultimately to advance the political interests of the Republic of China, Sandra Joyce, vice president of Google Cloud and Mandiant Intelligence, noted that they have yet to formally attribute the group and its work to the Chinese government.

Kristen Dennesen, reporting analyst at TAG, said DRAGONBRIDGE’s activity was fairly low and spammy, reflecting the unclear targeting and impact of many digital influence operations, but it still required blocking 50,000 YouTube channels and deactivating 100,000 using Google account group.

In cases where there are clear Chinese interests, such as former House Speaker Nancy Pelosi, a California Democrat, visit taiwan Parts of DRAGONBRIDGE have become clearer and more focused over the last year.

Dennesen said it was very demeaning of the United States, promoting interests and pro-China, and in some cases, we saw that it was quite high-quality in terms of content, and sometimes it was very coherent.