Chinese hackers target Southeast Asian countries, report says

Chinese President Xi Jinping attends an event commemorating the 110th anniversary of the Xinhai Revolution at the Great Hall of the People in Beijing on October 9, 2021. (Andy Wong / AP)

This year, Chinese hackers have targeted military and civilian organizations in several Southeast Asian countries, particularly those with territorial claims or similar strategic infrastructure projects, suggesting state involvement, a a US-based cybersecurity firm said in a new study released Wednesday night.

Malaysia, Indonesia and Vietnam have been the top three countries of focus over the past nine months, said Insikt Group, the Massachusetts-based threat research arm of Recorded Future. The pirates also targeted several other countries, including the Philippines, Laos, Cambodia and Thailand, he said.

The intrusion campaigns identified almost certainly support key strategic objectives of the Chinese government, such as gathering intelligence on countries engaged in territorial disputes in the South China Sea or related to projects and countries strategically important to the Initiative. Belt and Road (BRI), said Insikt Group in its report.

The hackers focused on the offices of the Thai and Malaysian prime ministers, the foreign ministries of Indonesia and Malaysia, and their armies, he said. Insikt said it had identified more than 400 unique servers in Southeast Asia communicating with infected networks that were likely linked to Chinese state-sponsored actors, adding that it had no idea what specific data might have been. be obtained. The group attributed much of the activity to a Chinese state-sponsored entity which it labeled Threat Activity Group 16.

We also identified evidence suggesting that TAG-16 shares custom abilities with the People’s Liberation Army (PLA)-linked RedFoxtrot business group, he said. Insikt said it notified all affected countries in October.

China has dismissed Insikts’ findings.

We oppose the dissemination of disinformation for political purposes to deceive the international community and sow discord among countries in the region, Chinese Foreign Ministry spokesman Wang Wenbin said on Thursday during a briefing. regular press in Beijing.

China has previously rejected reports from Recorded Future, including findings in September this year that Chinese state-sponsored hackers infiltrated and likely stole data from an Indian government agency responsible for a database. national identification.

In May, Insikt said it identified suspected intrusive activity in the Chinese state-sponsored network targeting telecommunications, government and state organizations with Laos. The Lao National Committee for Special Economic Zones and the National Business Database have been identified as targets, he said. Laos this month inaugurated a nearly $ 6 billion Chinese-built railway connecting the country to southern China.

The cybersecurity group said the Cambodian foreign ministry as well as the country’s only international and commercial deep-sea port, the Autonomous Port of Sihanoukville, were targeted in September.

The scale and scope of China’s cyberespionage program remains unmatched, as evidenced by the large number of separate actors with operational tasks in specific geographic regions, the Insikt Group wrote. These actors, he said, included many threatening activity groups linked to the PLA Strategic Support Force and the Ministry of State Security (MSS).

Vietnam’s Foreign Affairs spokesperson Le Thi Thu Hang did not address details of the report, but said in an online briefing Thursday that the government is still paying close attention to it and has released various guidelines, policies and measures to ensure cybersecurity and information security. She added that the country is ready to cooperate with the international community on this issue.

Filipino Defense Secretary Delfin Lorenzana told Bloomberg he was not aware of any recent cyberattacks on the country’s navy and would task intelligence officials to look into the matter. Other countries did not immediately respond to the report.