China-Linked Hackers Could Be Behind Cyberattacks On Russian State Agencies, Researchers Say (therecord.media) 46
According to Kaspersky, hackers linked to Chinese threat actors have targeted Russian state agencies and tech companies in a campaign named EastWind. The Record reports: [T]he attackers used the GrewApacha remote access trojan (RAT), an unknown PlugY backdoor and an updated version of CloudSorcerer malware, which was previously used to spy on Russian organizations. The GrewApacha RAT has been used by the Beijing-linked hacking group APT31 since at least 2021, the researchers said, while PlugY shares many similarities with tools used by the suspected Chinese threat actor known as APT27.
According to Kaspersky, the hackers sent phishing emails containing malicious archives. In the first stage of the attack, they exploited a dynamic link library (DLL), commonly found in Windows computers, to collect information about the infected devices and load the additional malicious tools. While Kaspersky didn't explicitly attribute the recent attacks to APT31 or APT27, they highlighted links between the tools that were used. Although PlugY malware is still being analyzed, it is highly likely that it was developed using the DRBControl backdoor code, the researchers said. This backdoor was previously linked to APT27 and bears similarities to PlugX malware, another tool typically used by hackers based in China.
According to Kaspersky, the hackers sent phishing emails containing malicious archives. In the first stage of the attack, they exploited a dynamic link library (DLL), commonly found in Windows computers, to collect information about the infected devices and load the additional malicious tools. While Kaspersky didn't explicitly attribute the recent attacks to APT31 or APT27, they highlighted links between the tools that were used. Although PlugY malware is still being analyzed, it is highly likely that it was developed using the DRBControl backdoor code, the researchers said. This backdoor was previously linked to APT27 and bears similarities to PlugX malware, another tool typically used by hackers based in China.
Vault7 (Score:1)
They make claims like this as if Vault7 doesn't exist.
The US normalized this (Score:3, Insightful)
Re: (Score:2, Insightful)
We survived with pen and paper for a few dozen decades. The games are a bit more boring and the graphics suck,
Re: (Score:2)
The U.S. just wanted show off? The spooks don't usually show off, it sort defeats their purpose.
Re: (Score:2)
(Don't take this too serious)
Re: (Score:1)
Re: (Score:3)
You're largely right, but it is possible to massively raise the difficulty level.
This would require a few changes to how things are done.
For example, it would be necessary to develop a strong but appropriate lemon law for software and CPUs/GPUs, along with a far more effective system+organisation for testing, evaluating, and certifying software and processors, not just for security but also for robustness and reliability.
(Because this'll necessitate linking against debugging libraries, particularly debuggin
Step 1 (Score:2)
Re: (Score:2)
Re: (Score:3)
More to the point, there is nothing the West could do to stop it. China is making headway with the 'stans, and they would indeed initially welcome it. Eventually, they'll figure out what the African countries are learning, China through its CCP is merely a bloodsucking leech.
Re: (Score:2)
>Eventually, they'll figure out what the African countries are learning, China through its CCP is merely a bloodsucking leech.
To be fair, so far China's been a bit kinder to African nations than the British Empire or the US. So far.
What's the problem? (Score:4, Insightful)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Stop watching T.V., bad for you, make you imagine things not there.
Re: (Score:2)
Re: (Score:2)
It's the same problem as with any other non-discriminatory weapon. Someone you don't like being hit today is no guarantee you won't be hit tomorrow.
Indeed, as slow data corruption is a common technique, you can't be sure you're not already a dead victim who just doesn't know it yet.
Re: (Score:2)
Someone you don't like being hit today is no guarantee you won't be hit tomorrow.
Never said it did. Spreading their resources around is still better than concentrating them all on us.
So that's what Xi meant (Score:4, Insightful)
Re: (Score:2)
I thought Russia and China were allies
You would think Russia remembered that masterclass lesson in backstabbing called the Molotov-Ribbentrop Pact [wikipedia.org] that happened to them. But the Russians are phenomenally good at forgetting the lessons of the past and never improving their lot in general.
Re: (Score:2)
I thought Russia and China were allies ....
Every country uses various means of espionage against even their "allies", for no one (with a brain) trusts their allies to always tell the truth, the whole truth, and nothing but the truth. "Trust, but verify".
Money and Bills?... (Score:2)
I thought Russia and China were allies, why would they be targeting each other with cyber attacks?
...allies until China got mad after realizing that Russia won't pay and is blocked from paying all the rubles they owe for parallel importing banned goods, probably?
So a few ransomware attacks to recoup that lost money would be the final target?
...and Russia being mad that China ceded to international pressure to stop parallel imports ?
So retaliation?
Re: Allies (Score:1)
Re: (Score:3)
I thought Russia and China were allies,
There is no honor among thieves.
Re: (Score:1)
Re: (Score:2)
Note at least from what I saw, they said "Chinese" not necessarily "Chinese government". Being based in a country is very different from being a state actor.
State Actors? (Score:2)
Re: (Score:2)
>I don't think there is any way to even know if a hacker is a state actor, much less identify which state.
You know by their choice of target, the difficulty of what they've done (especially if it requires physical access and/or detailed site-specific knowledge), and whether they are under legitimate threat of arrest where they live.
Then of course there's the old fashioned spying where you simply learn about a hacking group from someone who knows and is either directly reporting to you or is monitored by
Re: (Score:2)
we just go by what our intelligence agencies and security experts (who may be influenced by our intelligence agencies) tell us through the media.
I don't think any of those are reliable sources. The reality is the claims these are state actors are mostly self-serving for intelligence agencies. If they were common criminals they wouldn't really have a role, it would be a law enforcement problem.
Re: (Score:2)
Then again, the USA got caught doing the same thing to its "allies" in the EU & the UN.
Re: (Score:2)
My impression is that certain groups tend to use a common set of tools and are known, through conventional espionage, to be receiving funding or other state assistance. It's then assumed that the state is effectively controlling that group.
Re: (Score:1)
In the real world, it's more like you execute a series of warrants and usually the trail is cold before you can get all that done, but occasionally you get lucky and are able to actually trace the attack back to an IP address, and then you have to id
Interesting (Score:4, Insightful)
So a security group under Putin's control is accusing China of cyber warfare against Russia.
That's interesting, because we do know that in Russia's sanction-weakened state that China's taking the opportunity to slowly turn Russia into a vassal state for the natural resources. Putin's not that stupid, and it's what he'd do in their place so he has to know it's happening... he's cornered himself to where letting China bleed him slowly is preferable to letting the world suffocate him quickly.
So is this announcement Putin's paranoia and fear making him question that deal and starting to break from China?
Re: (Score:2)
and starting to break from China?
Let's just hope it doesn't result in another Red Star Rogue [wikipedia.org] plot.
Re: (Score:2)
Putin is not that stupid? Believing his own spooks, he invaded Ukraine declaring it not a real country, thus turning a country into a real country that is hell bent on defeating him. Using his Kleptocrats to run his own country into the ground also counts as stupid. Getting into bed with a neighbor who could eat Russia for lunch is also stupid.
Re: (Score:2)
I don't think he's a genius, and I fully believe it is stupid to bleed the economy and torch the world around you for temporary personal enrichment, but this kind of basic strategy doesn't exactly require genius to see.
As I said, given the opportunity it's exactly what he'd do to someone else. That's why I would expect him to perceive this as the same thing being done to Russia.
Re: (Score:2)
Re: (Score:2)
Note they don't say "state actor" or "cyber warfare". They say the campaign resembles other campaigns by people in China. They make no assertion that the government is involved, or that it is 'warfare'.
"According to Kaspersky"...are you serious? (Score:2)
Re: (Score:1)
Re: (Score:2)
Re: (Score:2)
comments (Score:2)