In 2017, FireEye announced that they have observed APT32 conducting cyberespionage operations targeting foreign companies with a vested interest in Vietnam’s manufacturing, consumer products, and hospitality sectors. The campaign has gone about since 2013. There are indicators that APT32 actors are targeting peripheral network security and technological infrastructure corporations. Some of the targets have included government agencies in Cambodia, oil companies from China, and maritime construction firms. The affected economies have included Australia, Brunei, Cambodia, China, Germany, Indonesia, Laos, Malaysia, Myanmar, Philippines, Singapore, Thailand, USA and Vietnam. The objectives are likely to be diverse, ranging from political objectives to stealing sensitive business information.

In 2017, FireEye announced that they have observed APT32 conducting cyberespionage operations targeting foreign companies with a vested interest in Vietnam’s manufacturing, consumer products, and hospitality sectors. The campaign has gone about since 2013. There are indicators that APT32 actors are targeting peripheral network security and technological infrastructure corporations. Some of the targets have included government agencies in Cambodia, oil companies from China, and maritime construction firms. The affected economies have included Australia, Brunei, Cambodia, China, Germany, Indonesia, Laos, Malaysia, Myanmar, Philippines, Singapore, Thailand, USA and Vietnam. The objectives are likely to be diverse, ranging from political objectives to stealing sensitive business information

FireEye(Mandiant), Volexity, ESET

None

‍

High Confidence (10 out of 12)

• Private entities are a majority of known sectors targeted in the intrusion (2 points)
• Commercial data are known to be the dominant targets of intrusion (3 points)
• APT actor is strongly associated with economic espionage operations, with motivations strongly tied to certain states’ industrial policy objectives (3 points)
• No concrete evidence that data stolen was used to aid domestic private businesses of malign state, but data stolen likely aligns with malign state’s industrial policies (2 points)

From January 2020 until 2021, cybersecurity firms detected a massive cyberespionage campaign targeting private entities. These campaigns were conducted in three clusters. First, from January to March 2020, there was a broad campaign against 75 private entities in 20 countries, with a focus on industries ranging from petrochemicals to defense industrial base. Mandiant notes that while it’s unclear if APT41 scanned the Internet and attempted exploitation en masse or selected a subset of specific organizations to target, the victims appear to be more targeted in nature. The economies affected were Australia, Canada, Denmark, Finland, France, India, Italy, Japan, Malaysia, Mexico, Philippines, Poland, Qatar, Saudi Arabia, Singapore, Sweden, Switzerland, UAE, UK and USA.

Second, in September 2020, hackers associated with APT41 were charged by the U.S. Department of Justice in connection with computer intrusion campaigns against more than 100 victims globally, including in Indonesia, Malaysia, Thailand, and Vietnam. The entities affected were those that specialize in software development, manufacturers, telecommunications, non-profit, universities, and civil society organizations.

Third, from July 2020 until August 2021 (ongoing as of then), Trend Micro observed an espionage campaign against victims in India, m, Malaysia, Philippines, Taiwan, and Vietnam in the airline, computer hardware, automotive, infrastructure, publishing, media, and IT industries.

US Government, Mandiant; Trend Micro

In second incident, U.S. Department of Justice indicts seven individuals (two arrested, five remaining)

High Confidence (9 out of 12)

• Private entities are a majority of known sectors targeted in the intrusion (2 points)
• Commercial data are likely to have been targeted (2 points)
• APT actor is strongly associated with economic espionage operations, with motivations strongly tied to certain states’ industrial policy objectives (3 points)
• No concrete evidence that data stolen was used to aid domestic private businesses of malign state, but data stolen likely aligns with malign state’s industrial policies (2 points)

In June 2021, Recorded Future, an American cybersecurity firm, recorded a cyber campaign by Threat Activity Group 22 (TAG-22) that breached networks in Nepal, Philippines, Taiwan, and Hong Kong. The cyber intrusions largely focused on academic and governmental networks. The selection of the Industrial Technology Research Institute (ITRI) in Taiwan as a target is critical since the organization has been responsible for setting up and incubating several Taiwanese technology firms. ITRI also works on several research and development projects related to smart living, quality health, sustainable environment, and technology, issues that align with China’s development priorities under its 14th Five Year Plan. Since 2019, ITRI has imposed stricter cybersecurity measures, including by banning all smartphones and computers made by China’s Huawei from their internal network. The attacks had come amidst recent attacks by Chinese hacking groups at multiple organisations across Taiwan’s semiconductor industry. Beyond ITRI, other major targets had included Nepal Telecom and the Department of Information and Communications Technology. Given their employment of Winnti tools, Recorded Future suspects that TAG-22 are groups of private contractors operating on behalf of China’s Ministry of State Security.

Recorded Future

None

High Confidence (10 out of 12)

• Private entities are either the sole or the primary targets of intrusion (3 points)
• Commercial data are known to be the dominant targets of intrusion (3 points)
• APT actor has some history of stealing IP and other commercially valuable data (2 points)
• No concrete evidence that data stolen was used to aid domestic private businesses of malign state, but data stolen likely aligns with malign state's industrial policies (2 points)