In 2013, Mandiant/Fireye discovered that APT1 has been conducting cyberespionage operations since 2006. The cyberespionage operation affected or targeted at least 141 organizations across 20 major industries – ranging from IT and Transporation to Engineering Services and Chemicals – primarily in English-speaking countries, including the U.S. (115 multinationals), India (3), Singapore (2). Possibly linked to the ShadyRAT campaign, which McAfee discovered in 2011, the campaign may have also affected India, Indonesia, Vietnam, Japan, Denmark, and Germany. Given that the largest targets of cyberespionage were private entities, it is very much possible that the APT has stolen vast amounts of commercial secrets that relate to multiple sets of economic sectors and industries.

The perpetrator was suspected to be APT1 and ShadyRAT, two possible sets of hacking groups that may have some affiliations with the Second Bureau of the Third Department of PLA’s General Staff Department.
‍
There was a rise in attacks after 2010. Of note, 13 out of 16 IT organizations attacked are from 2010-2012. Most incidents across the board also seem to occur after 2010. It may be closely tied to the 12th Five-Year Plan (2011-2015), which is a cyclical strategy document by the CPC leadership that steers the general direction of economic initiatives: namely next-generation information technology, high-end equipment manufacturing, alternative energy, and new materials. Fundamentally, in launch occurred not long after the 2006 National Medium- and Long-Term Plan For the Development of Science and Technology, China laid out its goals to reduce its dependence on the West for advanced technologies, and on the U.S. and Japan in particular.

Mandiant; McAffee

The U.S. Department of Justice indicted five Chinese military officers associated with this hack.

High Confidence (9 out of 12)

• Private entities are a majority of known sectors targeted in the intrusion (2 points)
• Commercial data are known to be the dominant targets of intrusion (3 points)
• APT actor has some history of stealing IP and other commercially valuable data (2 points)
• No concrete evidence that data stolen was used to aid domestic private businesses of malign state, but data stolen likely aligns with malign state's industrial policies (2 points)

Dubbed “Operation Pzchao” by Romanian cybersecurity firm Bitdefender, this cyber campaign targeted government institutions, as well as private firms in the technology, education, and telecommunications sector that are primarily based in the U.S., though with also some cases in several other countries. Bitdefender attributed the attack to Emmisary Panda, a China-based threat group active since 2010. The group has been suspected of conducting espionage operations on civil society organisations and governments deemed critical of the PRC, including advocacy organisations on Taiwan and Tibetan independence. While this threat group’s focus has traditionally been on political espionage, we suspect – with moderate confidence¬ – that this attack had possible economic objectives as well. Initiated in July 2017, this cyber incident came against the backdrop of developments in China’s technology and telecommunications sector, including Beijing laying out a development plan to become the world leader in AI by 2030. The Iron Tiger APT (aka Panda Emissary or TG-3390) is active at least since 2010 and targeted organization in APAC, but since 2013 it is attacking high-technology targets in the US.

Bitdefender

None

Moderate Confidence (7 out of 12)

• Private entities are a majority of known sectors targeted in the intrusion (2 points)
• No clear information if commercial data is targeted (1 point)
• APT actor has some history of stealing IP and other commercially valuable data (2 points)
• No concrete evidence that data stolen was used to aid domestic private businesses of malign state, but data stolen likely aligns with malign state’s industrial policies (2 points)

In 2017, FireEye announced that they have observed APT32 conducting cyberespionage operations targeting foreign companies with a vested interest in Vietnam’s manufacturing, consumer products, and hospitality sectors. The campaign has gone about since 2013. There are indicators that APT32 actors are targeting peripheral network security and technological infrastructure corporations. Some of the targets have included government agencies in Cambodia, oil companies from China, and maritime construction firms. The affected economies have included Australia, Brunei, Cambodia, China, Germany, Indonesia, Laos, Malaysia, Myanmar, Philippines, Singapore, Thailand, USA and Vietnam. The objectives are likely to be diverse, ranging from political objectives to stealing sensitive business information.

In 2017, FireEye announced that they have observed APT32 conducting cyberespionage operations targeting foreign companies with a vested interest in Vietnam’s manufacturing, consumer products, and hospitality sectors. The campaign has gone about since 2013. There are indicators that APT32 actors are targeting peripheral network security and technological infrastructure corporations. Some of the targets have included government agencies in Cambodia, oil companies from China, and maritime construction firms. The affected economies have included Australia, Brunei, Cambodia, China, Germany, Indonesia, Laos, Malaysia, Myanmar, Philippines, Singapore, Thailand, USA and Vietnam. The objectives are likely to be diverse, ranging from political objectives to stealing sensitive business information

FireEye(Mandiant), Volexity, ESET

None

‍

High Confidence (10 out of 12)

• Private entities are a majority of known sectors targeted in the intrusion (2 points)
• Commercial data are known to be the dominant targets of intrusion (3 points)
• APT actor is strongly associated with economic espionage operations, with motivations strongly tied to certain states’ industrial policy objectives (3 points)
• No concrete evidence that data stolen was used to aid domestic private businesses of malign state, but data stolen likely aligns with malign state’s industrial policies (2 points)

From January 2020 until 2021, cybersecurity firms detected a massive cyberespionage campaign targeting private entities. These campaigns were conducted in three clusters. First, from January to March 2020, there was a broad campaign against 75 private entities in 20 countries, with a focus on industries ranging from petrochemicals to defense industrial base. Mandiant notes that while it’s unclear if APT41 scanned the Internet and attempted exploitation en masse or selected a subset of specific organizations to target, the victims appear to be more targeted in nature. The economies affected were Australia, Canada, Denmark, Finland, France, India, Italy, Japan, Malaysia, Mexico, Philippines, Poland, Qatar, Saudi Arabia, Singapore, Sweden, Switzerland, UAE, UK and USA.

Second, in September 2020, hackers associated with APT41 were charged by the U.S. Department of Justice in connection with computer intrusion campaigns against more than 100 victims globally, including in Indonesia, Malaysia, Thailand, and Vietnam. The entities affected were those that specialize in software development, manufacturers, telecommunications, non-profit, universities, and civil society organizations.

Third, from July 2020 until August 2021 (ongoing as of then), Trend Micro observed an espionage campaign against victims in India, m, Malaysia, Philippines, Taiwan, and Vietnam in the airline, computer hardware, automotive, infrastructure, publishing, media, and IT industries.

US Government, Mandiant; Trend Micro

In second incident, U.S. Department of Justice indicts seven individuals (two arrested, five remaining)

High Confidence (9 out of 12)

• Private entities are a majority of known sectors targeted in the intrusion (2 points)
• Commercial data are likely to have been targeted (2 points)
• APT actor is strongly associated with economic espionage operations, with motivations strongly tied to certain states’ industrial policy objectives (3 points)
• No concrete evidence that data stolen was used to aid domestic private businesses of malign state, but data stolen likely aligns with malign state’s industrial policies (2 points)