Operation Cloudhopper (2017)

From International cyber law: interactive toolkit
Jump to navigation Jump to search
Date The campaign has been active since at least 2016, continuing throughout 2018.[1] A report published by PwC and BAE systems exposed the cyberespionage operation in April 2017.[2]
Suspected actor APT10 Group (also known as Stone Panda, POTASSIUM, MenuPass and Red Apollo), a hacking group allegedly tied to the Tianjin bureau of the Chinese Ministry of State Security.[3] Following the initial charge circulated by the US Justice Department which indicted two Chinese hackers belonging to APT10,[4] Britain,[5] Australia,[6] and New Zealand[7] publicly made formal statements indicating APT10 as acting on behalf of the Chinese government. Chinese authorities denied[8] any involvement in supporting or directing APT10.[9]
Target The group conducted a widespread cyber espionage campaign via cloud Managed IT Service Providers (MSPs), targeting a consistent number of enterprises[10] in North America, Europe, and South Asia.
Target systems n/a
Method The large scale campaign entailed the use of several malwares including customized variants of remote access Trojans such as PlugX, Poison Ivy, ChChes and Graftor. The malwares have been spear-phished through emails to collect credentials from targeting profiles of interest and access to their networks, in particular, the Managed IT Service Providers and their clients’ shared infrastructure. Having compressed and moved the data from the MSP customer’s network back onto the MSP, the hackers exfiltrated the stolen data to infrastructures they controlled.[11]
Purpose Intellectual property theft, most likely to gain economic advantages.
Result Gigabytes of intellectual property have been stolen from companies and government organizations from companies around the world.[12]
Aftermath On 21 December 2018, the US Justice Department announced an indictment against two Chinese nationals linked to the APT10 group.[13] The accusations amount to conspiracy to commit computer intrusions, wire fraud and aggravated identity theft.[14]
Analysed in Scenario 09: Economic cyber espionage

Collected by: Samuele De Tomas Colatin

  1. ↑ S Gallagher, “New data shows China has “taken the gloves off” in hacking attacks on US”, (1 November 2018), Ars Technica.
  2. ↑ PricewaterhouseCoopers LLP, BAE Systems, Report: “Operation Cloud Hopper”, (April 2017), PWC and BAE Systems.
  3. ↑ Council on Foreign Relations, “Cyber Operations Tracker”, CFR.
  4. ↑ The United States Department of Justice, “Two Chinese Hackers Associated with the Ministry of State Security Charged with Global Computer Intrusion Campaigns Targeting Intellectual Property and Confidential Business Information”, (20 December 2018), US DOJ Office of Public Affairs.
  5. ↑ UK Government Press Release, “UK and allies reveal global scale of Chinese cyber campaign”, (20 December 2018), UK Foreign and Commonwealth Office.
  6. ↑ Australian Ministry of Foreign Affairs, “Attribution of Chinese cyber-enabled commercial intellectual property theft”, (21 December 2018), Australian Department of Foreign Affairs and Trade.
  7. ↑ National Cyber Security Center of New Zealand, “Cyber campaign attributed to China”, (21 December 2018), The Government Communication Security Bureau.
  8. ↑ P Wen, “China denies 'slanderous' economic espionage charges from U.S., allies”, (21 December 2018), Reuters.
  9. ↑ Al Jazeera and News Agencies, “China rejects economic espionage accusations from US, allies”, (21 December 2018), Al Jazeera.
  10. ↑ UK National Cyber Security Centre, “Advisory: APT10 continuing to target UK organisations”, (20 December 2018), UK NCSC Alerts and Advisories.
  11. ↑ PricewaterhouseCoopers LLP, BAE Systems, Report: “Operation Cloud Hopper”, (April 2017), PwC and BAE Systems.
  12. ↑ Trend Micro Security News, “Operation Cloud Hopper: What You Need to Know”, (10 April 2017), Trend Micro Incorporated.
  13. ↑ FBI News Stories, “Chinese Hackers Indicted”, (20 December 2018), US Federal Bureau of Investigation.
  14. ↑ FBI Most Wanted List, “APT 10 GROUP”, US Federal Bureau of Investigation.
Retrieved from "https://cyberlaw.ccdcoe.org/wiki/Operation_Cloudhopper_(2017)?oldid=2406"