Operation Cloud Hopper is one of the largest sustained global cyber espionage campaigns. The operation has been traced back to at least 2016 and has targeted managed IT service providers, thus acquiring potentially unprecedented access to IP and sensitive data of those MSPs as well as their clients across the globe. Some of these targets compromised include Fujitsu, Tata Consultancy Services, NTT Data, Dimension Data, Computer Sciences Corporation, DXC Technology, Ericsson, and IBM (see Operation Cloud Hopper). A wide range of sectors were affected, ranging from telecommunications to mining. The suspected targets of these operations were those that aligned with China’s national security and “Made in China” goals, focused primarily on valuable military and intelligence information as well as confidential business data. PwC, in cooperation with BAE Systems and the UK’s National Cyber Security Centre, attributed the attacks to APT10, a China-based hacking group. Symantec, similarly, found an advanced persistent threat campaign targeting companies in multiple sectors across 17 regions in Japan. This campaign was also attributed to Cloud Hopper (which they called Cicada).

Several countries, including the US and Australia, attributed Operation Cloud Hopper to a hacking group that has backing from the Chinese state.

PwC, Symantec, Governments of US, UK, New Zealand, and Australia

The U.S. Government held the Chinese government accountable for these campaigns, including indicting suspected hackers. Britain, Australia, and New Zealand also made formal statements indicating that APT10 was acting on behalf of the Chinese government. However, Chinese authorities have denied supporting or directing APT10

High Confidence (10 out of 12

• Private entities are a majority of known sectors targeted in the intrusion (2 points)
• Commercial data are known to be the dominant targets of intrusion (3 points)
• APT actor is strongly associated with economic espionage operations, with motivations strongly tied to certain states’ industrial policy objectives. (3 points)
• No concrete evidence that data stolen was used to aid domestic private businesses of malign state, but data stolen likely aligns with malign state’s industrial policies (2 points)

Dubbed “Operation Pzchao” by Romanian cybersecurity firm Bitdefender, this cyber campaign targeted government institutions, as well as private firms in the technology, education, and telecommunications sector that are primarily based in the U.S., though with also some cases in several other countries. Bitdefender attributed the attack to Emmisary Panda, a China-based threat group active since 2010. The group has been suspected of conducting espionage operations on civil society organisations and governments deemed critical of the PRC, including advocacy organisations on Taiwan and Tibetan independence. While this threat group’s focus has traditionally been on political espionage, we suspect – with moderate confidence¬ – that this attack had possible economic objectives as well. Initiated in July 2017, this cyber incident came against the backdrop of developments in China’s technology and telecommunications sector, including Beijing laying out a development plan to become the world leader in AI by 2030. The Iron Tiger APT (aka Panda Emissary or TG-3390) is active at least since 2010 and targeted organization in APAC, but since 2013 it is attacking high-technology targets in the US.

Bitdefender

None

Moderate Confidence (7 out of 12)

• Private entities are a majority of known sectors targeted in the intrusion (2 points)
• No clear information if commercial data is targeted (1 point)
• APT actor has some history of stealing IP and other commercially valuable data (2 points)
• No concrete evidence that data stolen was used to aid domestic private businesses of malign state, but data stolen likely aligns with malign state’s industrial policies (2 points)

In 2017, FireEye announced that they have observed APT32 conducting cyberespionage operations targeting foreign companies with a vested interest in Vietnam’s manufacturing, consumer products, and hospitality sectors. The campaign has gone about since 2013. There are indicators that APT32 actors are targeting peripheral network security and technological infrastructure corporations. Some of the targets have included government agencies in Cambodia, oil companies from China, and maritime construction firms. The affected economies have included Australia, Brunei, Cambodia, China, Germany, Indonesia, Laos, Malaysia, Myanmar, Philippines, Singapore, Thailand, USA and Vietnam. The objectives are likely to be diverse, ranging from political objectives to stealing sensitive business information.

In 2017, FireEye announced that they have observed APT32 conducting cyberespionage operations targeting foreign companies with a vested interest in Vietnam’s manufacturing, consumer products, and hospitality sectors. The campaign has gone about since 2013. There are indicators that APT32 actors are targeting peripheral network security and technological infrastructure corporations. Some of the targets have included government agencies in Cambodia, oil companies from China, and maritime construction firms. The affected economies have included Australia, Brunei, Cambodia, China, Germany, Indonesia, Laos, Malaysia, Myanmar, Philippines, Singapore, Thailand, USA and Vietnam. The objectives are likely to be diverse, ranging from political objectives to stealing sensitive business information

FireEye(Mandiant), Volexity, ESET

None

‍

High Confidence (10 out of 12)

• Private entities are a majority of known sectors targeted in the intrusion (2 points)
• Commercial data are known to be the dominant targets of intrusion (3 points)
• APT actor is strongly associated with economic espionage operations, with motivations strongly tied to certain states’ industrial policy objectives (3 points)
• No concrete evidence that data stolen was used to aid domestic private businesses of malign state, but data stolen likely aligns with malign state’s industrial policies (2 points)

From January 2020 until 2021, cybersecurity firms detected a massive cyberespionage campaign targeting private entities. These campaigns were conducted in three clusters. First, from January to March 2020, there was a broad campaign against 75 private entities in 20 countries, with a focus on industries ranging from petrochemicals to defense industrial base. Mandiant notes that while it’s unclear if APT41 scanned the Internet and attempted exploitation en masse or selected a subset of specific organizations to target, the victims appear to be more targeted in nature. The economies affected were Australia, Canada, Denmark, Finland, France, India, Italy, Japan, Malaysia, Mexico, Philippines, Poland, Qatar, Saudi Arabia, Singapore, Sweden, Switzerland, UAE, UK and USA.

Second, in September 2020, hackers associated with APT41 were charged by the U.S. Department of Justice in connection with computer intrusion campaigns against more than 100 victims globally, including in Indonesia, Malaysia, Thailand, and Vietnam. The entities affected were those that specialize in software development, manufacturers, telecommunications, non-profit, universities, and civil society organizations.

Third, from July 2020 until August 2021 (ongoing as of then), Trend Micro observed an espionage campaign against victims in India, m, Malaysia, Philippines, Taiwan, and Vietnam in the airline, computer hardware, automotive, infrastructure, publishing, media, and IT industries.

US Government, Mandiant; Trend Micro

In second incident, U.S. Department of Justice indicts seven individuals (two arrested, five remaining)

High Confidence (9 out of 12)

• Private entities are a majority of known sectors targeted in the intrusion (2 points)
• Commercial data are likely to have been targeted (2 points)
• APT actor is strongly associated with economic espionage operations, with motivations strongly tied to certain states’ industrial policy objectives (3 points)
• No concrete evidence that data stolen was used to aid domestic private businesses of malign state, but data stolen likely aligns with malign state’s industrial policies (2 points)