A group of state-sponsored hackers in China ran activities for personal gain at the same time as undertaking spying operations for the Chinese government in 14 different countries, the cybersecurity firm FireEye has said.
In a report released on Thursday, the company said the hacking group APT41 was different to other China-based groups tracked by security firms in that it used non-public malware typically reserved for espionage to make money through attacks on video game companies.
FireEye said despite the group’s focus on financial gain, the espionage activity linked to it was more closely aligned with the behaviour of state-sponsored actors.
APT41, which has been in operation since at least 2012, had repeatedly gained access to game development environments, with a particular focus on in-game currency, FireEye said.
In one case, it generated tens of millions of dollars in the game’s virtual currency, which was then credited to more than 1,000 accounts.
FireEye said some of the group’s attention to video game companies could be seen as a precursor to espionage activity. In one case in 2014, it inserted malicious code into legitimate video game files in order to distribute malware. The group used similar methods to target supply chain companies.
FireEye found an email address used in spear-phishing attacks for both a Taiwanese newspaper in 2016 and for a cryptocurrency exchange in 2018, suggesting email reuse by APT41, and also identified source code overlap in malware used in a 2016 attack on a US-based game development studio and supply chain compromises in 2017 and 2018.
APT41 targets industries associated with China’s economic plans, or to gather intelligence for upcoming mergers and acquisitions, or political events.
FireEye said APT41 had targeted organisations in 14 countries over seven years – France, India, Italy, Japan, Myanmar, the Netherlands, Singapore, South Korea, South Africa, Switzerland, Thailand, Turkey, the UK and the United States.
The sectors targeted were healthcare, high tech, media, pharmaceuticals, retail, software companies, telecoms, travel services, education, video games and virtual currencies.
Some of the espionage-related activity included intruding on a retailer planning an unpublicised partnership with a Chinese company, targeting telecommunications companies’ call records for data collection, and sending spear-phishing emails to Hong Kong media organisations known for pro-democracy editorial content.
FireEye said that it assessed “with high confidence” that APT41 was attributable to Chinese nationals working on behalf of the Chinese state, and APT41’s capabilities and targeting had widened over time, potentially putting more organisations at risk.
“APT41’s links to both underground marketplaces and state-sponsored activity may indicate the group enjoys protections that enables it to conduct its own for-profit activities, or authorities are willing to overlook them,” the report said.
“It is also possible that APT41 has simply evaded scrutiny from Chinese authorities. Regardless, these operations underscore a blurred line between state power and crime that lies at the heart of threat ecosystems and is exemplified by APT41.”
FireEye’s senior vice president of global threat intelligence, Sandra Joyce, said in a statement APT41 was well-resourced and skilled.
“Their aggressive and persistent operations for both espionage and cybercrime purposes distinguish APT41 from other adversaries and make them a major threat across multiple industries.”
APT41 is distinct from APT10, which the security firm Cybereason said in June had compromised at least 10 global telecommunications companies seeking to obtain data on high-value targets.
Source: The Guardian
