China-backed hackers targeted EU officials to try and steal economic secrets, US cybersecurity firm says

Hackers from a group known for targeting Tibetan dissidents sent phishing emails mimicking WHO Covid-19 guidance, according to US firm Proofpoint
It said in a report on Wednesday that the malware, known as Sepulcher, allows attackers to read, write and delete files, among other things

Computer hackers

Bloomberg

Published: 7:40pm, 2 Sep 2020

Why you can trust SCMP

A Chinese nation-state hacker group targeted European government officials, diplomats, non-profit organisations and other global entities in a phishing campaign designed to gather intelligence about global economies reeling from the coronavirus pandemic, according to a US cybersecurity firm.

In March, hackers from a group known as APT TA413 sent phishing emails mimicking the World Health Organisation’s Covid-19 guidance in an attempt to lure victims into clicking on an attachment containing malicious code, the California-headquartered Proofpoint said in a report on Wednesday. It said the malicious email was sent to “numerous entities involved with economic policy and forecasting within Europe”.

US indicts Chinese hackers on charges of targeting coronavirus vaccine data

The same strain of malware was discovered in a phishing campaign in July targeting Tibetan dissidents, which the TA413 hacker group is best known for targeting, Proofpoint said.

The malware, called Sepulcher, allows attackers to read, write and delete files, among other functionalities. It is not clear to what extent the hackers were able to penetrate the networks of the groups that were targeted.

01:40

Chinese PLA officers charged with stealing personal data of Americans in Equifax credit agency hack

The campaign’s focus on economic, diplomatic and legislative entities in Europe suggests a momentary realignment for the Chinese hackers “to collect information on global economies cast into upheaval as a result of Covid-19,” according to the report.

Top officials at the WHO have also been targeted by suspected nation-state hackers earlier this year as they continue to lead the global response to the coronavirus pandemic.

The European Union in late July issued its first ever cyber-related sanctions against targeted individuals and entities, which included those involved in hacking operations tied to Chinese spies.

The Proofpoint report comes amid warnings from the US that Chinese hackers are targeting research on possible coronavirus treatments and vaccines. In July, the US Department of Justice accused two Chinese hackers of trying to steal data, including virus research, from Western companies in 11 countries.

Post