chinese espionage operations and tactics

However, they are also alleged to have collaborated with the charged Blackfly actors in order to make additional money by mounting attacks on computer gaming companies. The two men are reported to have worked for a time at Chengdu 404, the company that prosecutors identify as linked to Grayfly attacks. Two Chinese men – Zhang Haoran and Tan Dailin – are charged in a third indictment with collaborating with both groups. While Grayfly and Blackfly appear to be distinct operations, the indictments allege that there is a link between the two groups. The duo are alleged to have collaborated with other attackers to mount a string of attacks against computer game companies in order to obtain in-game digital items, such as currencies, and then selling them for profit. Wong is the founder and CEO of a company called Sea Gamer Mall, while Ling is its chief product officer and a shareholder. In a separate indictment, prosecutors allege that two Malaysian nationals – Wong Ong Hua and Ling Yang Ching – were involved in attacks that involved Blackfly tools and tactics. The attackers had not compromised Symantec software, and were not leveraging it in the attack. A dropper was signed with an invalid certificate with the subject 'McAfee, Inc.' The dropper then delivered several DLLs with file names that referenced Symantec software. Recent Blackfly activity observed by Symantec saw the group deploy a slightly modified version of the Winnti malware against a telecoms organization in Taiwan. A feature of the attack was their use of the names of security vendors in naming files in an attempt to avoid raising suspicions. However, Symantec has also observed attacks on the semiconductor, telecoms, materials manufacturing, pharmaceutical, media and advertising, hospitality, natural resources, fintech, and food sectors. The group is best known for its attacks on the computer gaming industry. Blackflyīlackfly has been active since at least 2010 and is known for attacks involving the PlugX/Fast (Backdoor.Korplug), Winnti/Pasteboy (Backdoor.Winnti), and Shadowpad (Backdoor.Shadowpad) malware families. Jiang was said to have a “working relationship” with the Chinese Ministry of State Security which would provide him and his associates with a degree of state protection. The indictment alleges that the three men were also involved in attacks against over 100 different organizations in the U.S., South Korea, Japan, India, Taiwan, Hong Kong, Malaysia, Vietnam, India, Pakistan, Australia, the United Kingdom, Chile, Indonesia, Singapore, and Thailand. The company describes itself as a network security specialist and claims to employ a team of white hat hackers who can perform penetration testing along with “offensive” and “defensive” security operations. The trio are based in the Chinese city of Chengdu and all hold senior positions in a company called Chengdu 404.

have charged three Chinese men – Jiang Lizhi, Qian Chuan, and Fu Qiang – with involvement in attacks that involve Grayfly tools and tactics. In one attack against a telecoms provider, Grayfly was seen using an internal tool capable of interacting with an SMS database, demonstrating that intelligence gathering was the motive of the attack. Backdoor.Motnug provides the attackers with comprehensive remote access to the network and creates proxy connections allowing access to hard-to-reach segments of a target network. In recent attacks, Symantec has seen Grayfly deploy Backdoor.Motnug against targeted organizations in conjunction with publicly available Cobalt Strike malware. Victims are frequently compromised by exploiting public facing web servers. It is known for using the Barlaiy/POISONPLUG and Crosswalk/ProxIP (Backdoor.Motnug) malware families in its attacks. They are interested in a wide range of sectors, including food, financial, healthcare, hospitality, manufacturing, telecoms, and government. Grayfly has been particularly active in recent years, mounting high volume espionage attacks against organizations spread across Asia, Europe, and North America. While some of our peers monitor APT41 as a single operation, Symantec regards it as two distinct actors: Grayfly and Blackfly. The attacks were attributed to a China-linked organization dubbed APT41 and involved a combination of intellectual property theft and financially motivated cyber crime. The other five are based in China and remain at large. Two of the men, who were based in Malaysia, were arrested and their extradition to the U.S. and multiple other countries in Asia and Europe. government has charged seven men in relation to hundreds of cyber attacks against organizations in the U.S.

Chinese espionage operations and tactics