Chinese Hackers Broke Into at Least 6 US State Governments Last Year: Mandiant

The APT41 hacking group was implicated in a 2020 indictment that accused Chinese hackers of targeting more than 100 companies.

By Reuters | Updated: 9 March 2022 12:23 IST

Chinese Hackers Broke Into at Least 6 US State Governments Last Year: Mandiant

APT41 is known to launch hacking operations both for espionage purposes and for financial gain

Highlights

The hackers exploited a software flaw known as Log4j
The group, which Mandiant refers to as APT41, targeted State agencies
Mandiant is being acquired by Google

Hackers working on behalf of the Chinese government broke into the computer networks of at least six state governments in the United States in the last year, according to a report released Tuesday by a private cybersecurity firm.

The report from Mandiant does not identify the compromised states or offer a motive for the intrusions, which began last May. But the Chinese group believed responsible for the breaches, APT41, is known to launch hacking operations both for old-fashioned espionage purposes and for financial gain.

“While the ongoing crisis in Ukraine has rightfully captured the world's attention and the potential for Russian cyber threats are real, we must remember that other major threat actors around the world are continuing their operations as-usual,” said Geoff Ackerman, a principal threat analyst at Reston, Virginia-based Mandiant.

Samsung Wins Patent for a Tri-Fold Smartphone With Specialised Barrier Layer for Improved Durability

He added in his statement: “We cannot allow other cyber activity to fall to the wayside, especially given our observations that this campaign from APT41, one of the most prolific threat actors around, continues to this day.”

State agencies remain ripe targets for hackers, even as the Biden administration has announced additional steps to safeguard federal government systems from hacking. That's an especially urgent concern in light of the massive SolarWinds espionage campaign in which Russian intelligence operatives exploited supply chain vulnerabilities to break into the networks of at least nine US agencies and dozens of private-sector companies.

In this case, the report says, the hackers exploited a previously unknown vulnerability in an off-the-shelf commercial web application used by 18 states for animal health management.

Universal Music Group Says It Is Suspending Operations in Russia

In addition, they exploited a software flaw known as Log4j that was discovered in December and that US officials said was possibly present in hundreds of millions of devices. The hackers began exploiting the vulnerability within hours of an advisory that disclosed it to the public, and late last month they re-compromised two previous US state government victims, the report said.

The hackers' “persistence to gain access into government networks, exemplified by re-compromising previous victims and targeting multiple agencies within the same state, (shows) that whatever they are after it is important,” Rufus Brown, a senior threat analyst at Mandiant, said in a statement. "We have found them everywhere, and that is unnerving.”

The same hacking group, APT41, was implicated in a 2020 Justice Department indictment that accused Chinese hackers of targeting more than 100 companies and institutions in the US and abroad, including social media and video game companies, universities and telecommunications providers.

“Through all the new, some things remain unchanged: APT41 continues to be undeterred by the US Department of Justice (DOJ) indictment in September 2020,” the Mandiant report states.

The Chinese government in the past has described itself as a staunch defender of cybersecurity and has dismissed US accusations of hacking as “groundless” speculation.

Mandiant is being acquired by Google in a deal worth $5.4 billion (roughly Rs. 41497.65 crore), the companies announced on Tuesday.

What should you know about MWC 2022? We discuss this on Orbital, the Gadgets 360 podcast. Orbital is available on Spotify, Gaana, JioSaavn, Google Podcasts, Apple Podcasts, Amazon Music and wherever you get your podcasts.

Affiliate links may be automatically generated - see our ethics statement for details.

Comments

For the latest tech news and reviews, follow Gadgets 360 on X, Facebook, WhatsApp, Threads and Google News. For the latest videos on gadgets and tech, subscribe to our YouTube channel. If you want to know everything about top influencers, follow our in-house Who'sThat360 on Instagram and YouTube.