Operation Cloud Hopper is one of the largest sustained global cyber espionage campaigns. The operation has been traced back to at least 2016 and has targeted managed IT service providers, thus acquiring potentially unprecedented access to IP and sensitive data of those MSPs as well as their clients across the globe. Some of these targets compromised include Fujitsu, Tata Consultancy Services, NTT Data, Dimension Data, Computer Sciences Corporation, DXC Technology, Ericsson, and IBM (see Operation Cloud Hopper). A wide range of sectors were affected, ranging from telecommunications to mining. The suspected targets of these operations were those that aligned with China’s national security and “Made in China” goals, focused primarily on valuable military and intelligence information as well as confidential business data. PwC, in cooperation with BAE Systems and the UK’s National Cyber Security Centre, attributed the attacks to APT10, a China-based hacking group. Symantec, similarly, found an advanced persistent threat campaign targeting companies in multiple sectors across 17 regions in Japan. This campaign was also attributed to Cloud Hopper (which they called Cicada).

Several countries, including the US and Australia, attributed Operation Cloud Hopper to a hacking group that has backing from the Chinese state.

PwC, Symantec, Governments of US, UK, New Zealand, and Australia

The U.S. Government held the Chinese government accountable for these campaigns, including indicting suspected hackers. Britain, Australia, and New Zealand also made formal statements indicating that APT10 was acting on behalf of the Chinese government. However, Chinese authorities have denied supporting or directing APT10

High Confidence (10 out of 12

• Private entities are a majority of known sectors targeted in the intrusion (2 points)
• Commercial data are known to be the dominant targets of intrusion (3 points)
• APT actor is strongly associated with economic espionage operations, with motivations strongly tied to certain states’ industrial policy objectives. (3 points)
• No concrete evidence that data stolen was used to aid domestic private businesses of malign state, but data stolen likely aligns with malign state’s industrial policies (2 points)

Ke3chang is a hacking group that is suspected to have affiliations to the Chinese state. The group has been active since at least 2010 and has targeted a diverse range of entities, ranging from government to industry, like aerospace and energy. Their tactics have evolved over time, utilizing various malware families such as Mirage and BS2005. The campaign has traditionally focused on Asian targets but have now moved on to focus on Latin America, particularly since 2017, when a series of cyber intrusions that affected foreign ministries, government agencies, and corporations in Chile, Guatemala, and Brazil were attributed to them. Since then, there has been a number of cyber incidents linked back to Ke3chang. Between September 19th and December 2021, MSTIC observed APT15 operations across several countries in Europe, Africa, and America, including Argentina, Brazil, Columbia, Mexico, and Peru. APT15 established long-term access and was able to schedule regular data exfiltration. MSTIC assesses this activity is in pursuit of economic and traditional intelligence collection objectives and will continue as China extends its BRI initiative. In December 2021, Microsoft’s legal team announced that they had obtained a court warrant that allowed it to seize 42 domains used by APT15. Meanwhile, between late 2022 and early 2023, APT15 leveraged a new backdoor called Backdoor.Graphican against the Americas, one European victim, and a corporation that sells products in Central and South America. While Latin America has historically been relatively free of APT attacks, Ke3chang has changed the dynamics and emerged as the highest profile hacking group focused on Latin American entities.

Microsoft; ESET

None

High Confidence (8 out of 12)

• Private entities are a majority of known sectors targeted in the intrusion. (2 points)
• Commercial data are likely to have been targeted (2 points)
• APT actor has some history of stealing IP and other commercially valuable data. (2 points)
• No concrete evidence that data stolen was used to aid domestic private businesses of malign state, but data stolen likely aligns with malign state's industrial policies (2 points)

From January 2020 until 2021, cybersecurity firms detected a massive cyberespionage campaign targeting private entities. These campaigns were conducted in three clusters. First, from January to March 2020, there was a broad campaign against 75 private entities in 20 countries, with a focus on industries ranging from petrochemicals to defense industrial base. Mandiant notes that while it’s unclear if APT41 scanned the Internet and attempted exploitation en masse or selected a subset of specific organizations to target, the victims appear to be more targeted in nature. The economies affected were Australia, Canada, Denmark, Finland, France, India, Italy, Japan, Malaysia, Mexico, Philippines, Poland, Qatar, Saudi Arabia, Singapore, Sweden, Switzerland, UAE, UK and USA.

Second, in September 2020, hackers associated with APT41 were charged by the U.S. Department of Justice in connection with computer intrusion campaigns against more than 100 victims globally, including in Indonesia, Malaysia, Thailand, and Vietnam. The entities affected were those that specialize in software development, manufacturers, telecommunications, non-profit, universities, and civil society organizations.

Third, from July 2020 until August 2021 (ongoing as of then), Trend Micro observed an espionage campaign against victims in India, m, Malaysia, Philippines, Taiwan, and Vietnam in the airline, computer hardware, automotive, infrastructure, publishing, media, and IT industries.

US Government, Mandiant; Trend Micro

In second incident, U.S. Department of Justice indicts seven individuals (two arrested, five remaining)

High Confidence (9 out of 12)

• Private entities are a majority of known sectors targeted in the intrusion (2 points)
• Commercial data are likely to have been targeted (2 points)
• APT actor is strongly associated with economic espionage operations, with motivations strongly tied to certain states’ industrial policy objectives (3 points)
• No concrete evidence that data stolen was used to aid domestic private businesses of malign state, but data stolen likely aligns with malign state’s industrial policies (2 points)