Jump to content

Double Dragon (hacking group)

Add links
From Wikipedia, the free encyclopedia
(Redirected from APT41)

Double Dragon (also known as APT41, BARIUM, Axiom, Winnti, Wicked Panda, Wicked Spider,[1] TG-2633, Bronze Atlas, Red Kelpie, Blackfly,[2] or Brass Typhoon[3]) is a hacking organization with alleged ties to the Chinese Ministry of State Security (MSS).[4] Classified as an advanced persistent threat, the organization was named by the United States Department of Justice in September 2020 in relation to charges brought against five Chinese and two Malaysian nationals for allegedly compromising more than 100 companies around the world.[5][6][7][8]

In 2019, the cybersecurity company FireEye stated with high confidence that the group was sponsored by the Chinese Communist Party (CCP) while conducting operations for financial gain.[9] The name "Double Dragon" originates from the duality of their operation, as they engage in espionage and individual financial gain.[10] The devices they use are usually used for state-sponsored intelligence.

Investigations conducted by FireEye have found APT 41 operations in multiple sectors, such as healthcare, telecommunications, and technology.[9] The group conducts many of its financial activities in the video game industry, including development studios, distributors, and publishers.[11]

Double Dragon
Formation2012
TypeAdvanced persistent threat
PurposeCyberespionage, cyberwarfare, Cybercrime
Region
China
Methodsspearphishing, malware, supply chain attack
Official language
Mandarin
OwnerMinistry of State Security
Formerly called
APT 41, Barium, Winnti, Wicked Spider, Wicked Panda, TG-2633, Bronze Atlas, Red Kelpie, Blackfly

Associated personnel

[edit]
An FBI wanted poster for 5 Chinese hackers associated with APT 41

In their earlier activities, APT 41 has used domains registered to the monikers "Zhang Xuguang" (simplified Chinese: 张旭光) and "Wolfzhi". These online personas are associated with APT 41's operations and specific online Chinese language forums, although the number of other individuals working for the group is unknown.[9] "Zhang Xuguang" has activity on the online forum Chinese Hackers Alliance (simplified Chinese: 华夏黑 客同盟). Information related to this individual includes his year of birth, 1989, and his former living in Inner Mongolia of PRC.[12] The persona has also posted on a forum regarding the Age of Wushu online game, using the moniker "injuriesa" in 2011.[9] Emails and online domains associated with "Wolfzhi" also lead to a data science community profile. Forum posts also suggest that the individual is from Beijing or the nearby province, Hebei.[9][12]

The FBI has issued wanted posters for Haoran Zhang, Dailin Tan, Chuan Qian, Qiang Fu, and Lizhi Jiang, whom they have found to be linked with APT 41.[1] Zhang and Tan were indicted on August 15, 2019, by the Grand jury in the District of Columbia for charges associated with hacking offences, such as unauthorized access to protected computers, aggravated identity theft, money laundering and wire fraud.[13] These actions were conducted on high-tech companies, video-game companies and six unnamed individuals from the United States and the United Kingdom while the two worked together. The FBI also charged Qian, Fu, and Jiang on August 11, 2020, for racketeering, money laundering, fraud, and identity theft.[13] All three individuals were part of the management team of the Chengdu 404 Network Technology company, where the three and coworkers planned cyber attacks against companies and individuals in industries like communications, media, security, and government.[14] Such operations were to occur in countries like the United States, Brazil, Germany, India, Japan, Sweden, Indonesia, Malaysia, Pakistan, Singapore, South Korea, Taiwan, and Thailand.[1]

In August 2020, Wong Ong Hua and Ling Yang Ching, were both charged with racketeering, conspiracy, identity theft, aggravated identity theft and fraud among others.[1] The United States Department of Justice says that the two Malaysian businessmen were working with the Chinese hackers to target video game companies in the United States, France, South Korea, Japan and Singapore and profit from these operations.[15] These schemes, particularly a series of computer intrusions involving gaming industries, were conducted under the Malaysian company Sea Gamer Mall, which was founded by Wong.[1] On September 14, 2020, Malaysian authorities arrested both individuals in Sitawan.[1]

Ties with the Chinese government

[edit]
Further information: Cyberwarfare by China

APT 41's operations are described as "moonlighting" due to their balance of espionage supported by the Chinese state and financially motivated activities outside of state authorization in their downtime.[9][16][17] As such, it is harder to ascertain whether particular incidents are state-directed or not.[18] The organization has conducted multiple operations against 14 countries, most notably the United States. Such activities include incidents of tracking, the compromising of business supply chains, and collecting surveillance data.[19] In 2022, APT 41 was linked to theft of at least $20 million in COVID-19 relief aid in the U.S.[20]

APT 41 uses cyber-espionage malware typically kept exclusive to the Chinese government.[21] This characteristic is common for other advanced persistent threats, as this allows them to derive information to spy on high-profile targets or make contact with them to gain information that benefits national interest.[22] APT 41 relation to the Chinese state can be evidenced by the fact that none of this information is on the dark web and may be obtained by the CCP.[23]

APT 41 targeting is consistent with the Chinese government's national plans to move into high research and development fields and increase production capabilities. Such initiatives coincide with the Chinese government's "Made in China 2025" plan, aiming to move Chinese production into high-value fields such as pharmacy, semi-conductors, and other high-tech sectors.[9][24]

FireEye has also evaluated with moderate confidence that APT 41 may engage in contract work associated with the Chinese government. Identified personas associated with the group have previously advertised their skills as hackers for hire. Their usage of HOMEUNIX and PHOTO in their personal and financially motivated operations, which are malware inaccessible to the public used by other state-sponsored espionage actors also evidences this stance.[9] It is also recognized in China that more skilled hackers tend to work in the private sector under government contracts due to the higher pay.[25] The FireEye report also noted that the Chinese state has depended on contractors to assist with other state operations focused on cyber-espionage, as demonstrated by prior Chinese advanced persistent threats like APT 10.[9][26] APT 41 is viewed by some as potentially made up of skilled Chinese citizens, who are used and employed by the Chinese government, leading to the assumptions that members of the group often work two jobs, which is supported by their operating hours.[9][27]

Techniques

[edit]

The operating techniques of APT 41 are distinct, particularly in their usage of passive backdoors compared to traditional ones. While traditional backdoors used by other advanced persistent threats are easily detectable, this technique is often much harder to identify.[9] Techniques applied in financially motivated APT 41 activity also include software supply-chain compromises. This has allowed them to implement injected codes into legitimate files to be distributed, which endanger other organizations by stealing data and altering systems.[28] Sophisticated malware is often deployed as well to remain undetected while extracting data.[27] Bootkits are also a type of malware used by the group, which is both difficult to detect and harder to find among other cyber espionage and cybercrime groups, making it harder for security systems to detect malicious code.[9] They also used Deadeye launcher and Lowkey malware to perform instant reconnaissance while remaining undetected.[29]

Spear-phishing emails are regularly used by APT 41 across both cyber espionage and financial attacks.[11] The group has sent many misleading emails which attempt to take information from high-level targets after gathering personal data to increase the likelihood of success.[30] Targets have varied from media groups for espionage activities to bitcoin exchanges for financial gain.[9]

Activities

[edit]

Espionage activity

APT 41's targeting is deemed by FireEye to correlate with China's national strategies and goals, particularly those regarding technology.[9][27][31] The targeting of tech firms align with Chinese interest in developing high-tech instruments domestically, as demonstrated by the 12th and 13th Five-Year Plans.[9] The attack on organizations in various different sectors is believed by FireEye to be indicative of APT 41 fulfilling specifically assigned tasks. Campaigns attributed to APT 41 also demonstrates that the group is used to obtain information before major political and financial events.[9][31] They have attacked companies in 14 different countries (and Hong Kong) including France, India, Italy, Japan, Myanmar, the Netherlands, Singapore, South Korea, South Africa, Switzerland, Thailand, Turkey, the United Kingdom, and the United States.[32] They have also been discovered in several different industries, including healthcare, telecommunications, and technology.[32]

The German company TeamViewer AG, behind the popular software of the same name which allowed system control remotely, was hacked in June 2016 by APT 41 according to a FireEye security conference.[33] The group was able to access the systems of TeamViewer users around the world and obtain management details and information regarding businesses.[33] In 2021 APT 41 launched several phishing scams in India that were found by the BlackBerry Research and Intelligence. They also stole data relating to new tax legislation and COVID-19 records and statistics. The group masked their identity to be the Indian government so that they would remain undetected.[34]

Financially motivated activities

APT 41 has targeted the video-game industry for the majority of its activity focused on financial gain.[9] Chinese internet forums indicated that associated members linked to APT 41 have advertised their hacking skills outside of Chinese office hours for their own profits.[27] In one FireEye reported case, the group was able to generate virtual game currency and sell it to buyers through underground markets and laundering schemes,[1][9][19] which could have been sold for up to US$300,000.[31] Although it is not a typical method used by the group for collecting money, APT 41 also attempted to deploy ransomware to profit from their operations.[9]

FireEye reports that because most of APT 41's financially motivated activity occurs later in the night or early in the morning, this could mean that these activities are completely unrelated to their espionage activities.[9] FireEye reports that APT 41's activities are on average between 10:00 to 23:00 China Standard Time, which is typical for Chinese tech workers who follow a "996" work schedule.[9]

APT 41 uses digital certificates obtained from video game developers and producers to sign their malware.[1][35] Through the application of over 19 different digital certificates, they target both gaming and non-gaming organizations to avoid detection and ensure compatibility with the systems of the target.[9] In 2012, a certificate from a South Korean game publisher was leveraged by APT 41 to sign the malware they use against other members of the gaming industry.[9] In 2021 APT 41 launched a series of attacks against the illegal gambling industry in China.[36]

U.S. Department of Justice

[edit]

On September 16, 2020, The United States Department of Justice released previously sealed charges against 5 Chinese and 2 Malaysian citizens for hacking more than 100 companies across the world.[1][37] These include firms involved in social-media, universities, telecommunications providers, software development, computer hardware, video-games, non-profit organizations, think tanks, foreign governments, and pro-democracy supporters in Hong Kong.[1][38] The attacks were said to have involved the theft of code, code signing certificates, customer data and business information.[37] Deputy Attorney General Jeffrey Rosen says that these actions involved having the hackers plant "back-doors" into software which allowed direct access to the systems of the software provider's company.[39] Two of the Chinese hackers also conducted attacks on the US gaming industry, which involved at least 6 companies in New York, Texas, Washington, Illinois, California, and the United Kingdom.[37]

The U.S. District Court for the District of Columbia distributed warrants calling for the seizure of accounts, servers, domain names, and web pages used by the hackers to conduct their operations. The FBI had the responsibility of executing the warrants as well as other private sector companies.[1] Microsoft also developed technical measures to prevent continued access to computer systems of victims. The Federal Bureau of Investigation released a report containing technical information that can be used by private sector groups.[1]

The Justice Department congratulated the Malaysian government, particularly the Attorney General's Chambers of Malaysia and the Royal Malaysia Police, in cooperating and aiding their arrest of the two Malay nationals, particularly since difficulties lie in arresting foreign hackers in general.[1][38] The press release mentioned Microsoft, Google, Facebook and Verizon Media as groups which helped their investigation.[1] The FBI also credited the Taiwanese Ministry of Justice Investigation Bureau, which helped provide information to US authorities after discovering APT 41 servers set up in California.[40][41]

Contrastingly, Rosen criticizes the Chinese Communist Party in their inaction when it came to assisting the FBI for the arrest of the 5 Chinese hackers associated with APT 41.[38][39] Rosen also claimed that the Chinese Communist Party was "making China safe for their cyber criminals" as they continue to assist them in espionage.[39] Chinese Foreign Ministry spokesman Wang Wenbin says that the US uses its own cybersecurity issues to "attack China" through spreading false information, and political manipulation.[37]

This announcement was made during President Donald Trump's re-election campaign, associating the Chinese Communist Party with various cyber-espionage attacks. Alongside Russia and Iran, China was identified in a national threat assessment to the election.[39][42]

[edit]

APT 41 has overlaps in activity with public reporting on other groups such as Barium and Winnti.[2] In terms of technique, there are many overlaps in digital certificates and malware. According to FireEye, one of the most prominent similarities is the use of similar malware, particularly HIGHNOON, across various areas of activity.[2] The use of the HIGHNOON malware was reported by FireEye and grouped under the APT 15 group (also known as Ke3chang, Vixen Panda, GREF, Playful Dragon).[9] However, this was later found to be the work of multiple Chinese groups which share tools and strategies. A digital certificate distributed by video game company YNK Japan was used by APT 41, as well as other APT groups such as APT 17 and APT 20.[9] A digital certificate allegedly from the Microsoft Certificate Authority was also used by APT 41 and APT 40.[9] Non-public malware used by APT 41 is linked to other alleged Chinese state-sponsored groups, which may indicate that APT 41 has shared resources with other groups.[9][17]

See also

[edit]

References

[edit]
  1. ^ a b c d e f g h i j k l m n "Seven International Cyber Defendants, Including "Apt41" Actors, Charged In Connection With Computer Intrusion Campaigns Against More Than 100 Victims Globally" (Press release). Washington. United States Department of Justice. September 16, 2020. Archived from the original on December 6, 2022. Retrieved April 20, 2021.
  2. ^ a b c "APT 41 – Threat Group Cards: A Threat Actor Encyclopedia". apt.thaicert.or.th. Archived from the original on June 2, 2021. Retrieved May 29, 2021.
  3. ^ "How Microsoft names threat actors". Microsoft. Retrieved January 21, 2024.
  4. ^ Volz, Dustin (March 8, 2022). "U.S. State Governments Hit in Chinese Hacking Spree". The Wall Street Journal. ISSN 0099-9660. Archived from the original on March 10, 2022. Retrieved March 10, 2022.
  5. ^ Cimpanu, Catalin. "US charges five hackers from Chinese state-sponsored group APT41". ZDNet. Archived from the original on September 16, 2020. Retrieved September 17, 2020.
  6. ^ "FBI Deputy Director David Bowdich's Remarks at Press Conference on China-Related Cyber Indictments". Federal Bureau of Investigation. Archived from the original on September 17, 2020. Retrieved September 17, 2020.
  7. ^ Rodzi, Nadirah H. (September 17, 2020). "Malaysian digital game firm's top execs facing extradition after US accuses them of cyber crimes". The Straits Times. Archived from the original on September 18, 2020. Retrieved September 17, 2020.
  8. ^ Yong, Charissa (September 16, 2020). "China acting as a safe haven for its cyber criminals, says US". The Straits Times. Archived from the original on September 17, 2020. Retrieved September 17, 2020.
  9. ^ a b c d e f g h i j k l m n o p q r s t u v w x y z aa APT41: A Dual Espionage and Cyber Crime Operation (Report). FireEye. August 7, 2019. Archived from the original on May 7, 2021. Retrieved April 20, 2020.
  10. ^ "[Video] State of the Hack: APT41 – Double Dragon: The Spy Who Fragged Me". FireEye. Archived from the original on June 2, 2021. Retrieved May 29, 2021.
  11. ^ a b Kendzierskyj, Stefan; Jahankhani, Hamid (2020), Critical National Infrastructure, C4ISR and Cyber Weapons in the Digital Age, Advanced Sciences and Technologies for Security Applications, Cham: Springer International Publishing, pp. 3–21, doi:10.1007/978-3-030-35746-7_1, ISBN 978-3-030-35745-0, S2CID 216513092, retrieved May 25, 2021
  12. ^ a b Eddy, Max (August 7, 2019). "APT41 Is Not Your Usual Chinese Hacker Group". PCMag Australia. Archived from the original on June 2, 2021. Retrieved May 29, 2021.
  13. ^ a b "Chinese and Malaysian hackers charged by US over attacks". BBC News. September 16, 2020. Archived from the original on June 2, 2021. Retrieved May 29, 2021.
  14. ^ Geller, Eric (September 16, 2020). "U.S. charges 5 Chinese hackers, 2 accomplices with broad campaign of cyberattacks". POLITICO. Archived from the original on December 2, 2022. Retrieved May 29, 2021.
  15. ^ "DOJ says five Chinese nationals hacked into 100 U.S. companies". NBC News. September 16, 2020. Archived from the original on June 2, 2021. Retrieved May 29, 2021.
  16. ^ Steffens, Timo (2020), "Advanced Persistent Threats", Attribution of Advanced Persistent Threats, Berlin, Heidelberg: Springer Berlin Heidelberg, pp. 3–21, doi:10.1007/978-3-662-61313-9_1, ISBN 978-3-662-61312-2, S2CID 226742586, retrieved May 25, 2021
  17. ^ a b Bing, Joseph Menn, Jack Stubbs, Christopher (August 7, 2019). "Chinese government hackers suspected of moonlighting for profit". Reuters. Archived from the original on May 31, 2021. Retrieved May 29, 2021.{{cite news}}: CS1 maint: multiple names: authors list (link)
  18. ^ Bateman, Jon. War, Terrorism, and Catastrophe in Cyber Insurance: Understanding and Reforming Exclusions. Carnegie Endowment for International Peace. OCLC 1229752520.
  19. ^ a b Kianpour, Mazaher (2021). "Socio-Technical Root Cause Analysis of Cyber-enabled Theft of the U.S. Intellectual Property – The Case of APT41". arXiv:2103.04901 [cs.CR].
  20. ^ Fitzpatrick, Sarah; Ramgopal, Kit (December 5, 2022). "Hackers linked to Chinese government stole millions in Covid benefits, Secret Service says". NBC News. Archived from the original on December 5, 2022. Retrieved December 5, 2022.
  21. ^ Naughton, Liam; Daly, Herbert (2020), Augmented Humanity: Data, Privacy and Security, Advanced Sciences and Technologies for Security Applications, Cham: Springer International Publishing, pp. 73–93, doi:10.1007/978-3-030-35746-7_5, ISBN 978-3-030-35745-0, S2CID 216436285, retrieved May 25, 2021
  22. ^ Lightfoot, Katie (2020). Examining Chinese Cyber-Attacks: Targets and Threat Mitigations (Msc). Utica College. ProQuest 2478472331. Archived from the original on March 31, 2022. Retrieved May 25, 2021.
  23. ^ Chen, Ming Shen (2019). "China's Data Collection on US Citizens:Implications, Risks, and Solutions" (PDF). Journal of Science Policy & Governance. 15. Archived (PDF) from the original on January 27, 2021. Retrieved May 25, 2021.
  24. ^ "Potential for China Cyber Response to Heightened U.S.–China Tensions" (Press release). Rosslyn. Cybersecurity and Infrastructure Security Agency. October 1, 2020. Archived from the original on April 20, 2021. Retrieved April 20, 2021.
  25. ^ Wong, Edward (May 22, 2013). "Hackers Find China Is Land of Opportunity". The New York Times. ISSN 0362-4331. Archived from the original on May 25, 2021. Retrieved May 25, 2021.
  26. ^ Lyall, Nicholas (March 1, 2018). "China's Cyber Militias". thediplomat.com. Archived from the original on March 2, 2018. Retrieved May 25, 2021.
  27. ^ a b c d Australian Universities under Attack: A CiLab PACE Project (PDF) (Report). Macquarie University. 2020. Archived (PDF) from the original on May 4, 2021.
  28. ^ Kim, Bong-Jae; Lee, Seok-Won (2020). "Understanding and recommending security requirements from problem domain ontology: A cognitive three-layered approach". Journal of Systems and Software. 169: 110695. doi:10.1016/j.jss.2020.110695. ISSN 0164-1212. S2CID 221592911.
  29. ^ capsnetdroff (August 4, 2022). "Decoding Chinese Hacking Syndicate – APT 41". CAPS India. Archived from the original on May 2, 2023. Retrieved May 2, 2023.
  30. ^ O'Leary, Daniel E. (2019). "What Phishing E-mails Reveal: An Exploratory Analysis of Phishing Attempts Using Text Analyzes". SSRN Electronic Journal. doi:10.2139/ssrn.3427436. ISSN 1556-5068. S2CID 239250225. Archived from the original on March 21, 2021. Retrieved May 25, 2021.
  31. ^ a b c Doffman, Zak. "Spies By Day, Thieves By Night—China's Hackers Using Espionage Tools For Personal Gain: Report". Forbes. Archived from the original on June 2, 2021. Retrieved May 29, 2021.
  32. ^ a b XTI, SOCRadar (March 15, 2022). "Deep Web Profile: APT41/Double Dragon". SOCRadar Cyber Intelligence Inc. Archived from the original on May 2, 2023. Retrieved May 2, 2023.
  33. ^ a b Hu, Chunhui; Zhang, Ling; Luo, Xian; Chen, Jianfeng (April 15, 2020). "Research of Global Strategic Cyberspace Security Risk Evaluation System Based on Knowledge Service". Proceedings of the 2020 3rd International Conference on Geoinformatics and Data Analysis. Icgda 2020. New York, NY, USA: ACM. pp. 140–146. doi:10.1145/3397056.3397084. ISBN 978-1-4503-7741-6. S2CID 220281616.
  34. ^ capsnetdroff (August 4, 2022). "Decoding Chinese Hacking Syndicate – APT 41". CAPS India. Archived from the original on May 2, 2023. Retrieved May 2, 2023.
  35. ^ "Software Supply Chain Attacks | CISA". www.cisa.gov. May 20, 2021. Archived from the original on May 24, 2021. Retrieved May 29, 2021.
  36. ^ Starks, Tim (July 12, 2021). "Suspected Chinese hackers return with unusual attacks on domestic gambling companies". www.cyberscoop.com. Cyberscoop. Archived from the original on July 17, 2021. Retrieved July 17, 2021.
  37. ^ a b c d "DOJ Indicts Chinese Hackers for Break-Ins at 100 Companies (3)". news.bloomberglaw.com. Archived from the original on June 2, 2021. Retrieved May 29, 2021.
  38. ^ a b c O’Keeffe, Dustin Volz, Aruna Viswanatha and Kate (September 16, 2020). "U.S. Charges Chinese Nationals in Cyberattacks on More Than 100 Companies". Wall Street Journal. ISSN 0099-9660. Archived from the original on June 2, 2021. Retrieved May 29, 2021.{{cite news}}: CS1 maint: multiple names: authors list (link)
  39. ^ a b c d Johnson, Kevin. "5 Chinese citizens at large, 2 Malaysian suspects arrested in global hacking campaign targeting gaming". USA TODAY. Archived from the original on June 2, 2021. Retrieved May 29, 2021.
  40. ^ "Taiwan, US nail Chinese hackers behind mass cyberattacks". Taiwan News. September 18, 2020. Archived from the original on June 2, 2021. Retrieved May 29, 2021.
  41. ^ "FBI agent thanks Taiwan for help in indicting Chinese hackers – Focus Taiwan". focustaiwan.tw (in Chinese). September 18, 2020. Archived from the original on June 2, 2021. Retrieved May 29, 2021.
  42. ^ Evanina, William (August 7, 2020). "STATEMENT BY NCSC DIRECTOR WILLIAM EVANINA: ELECTION THREAT UPDATE FOR THE AMERICAN PUBLIC" (Press release). Office of the Director of National Intelligence. Archived from the original on November 19, 2020. Retrieved May 29, 2021.


Retrieved from "https://en.wikipedia.org/w/index.php?title=Double_Dragon_(hacking_group)&oldid=1257676185"