In 2013, Mandiant/Fireye discovered that APT1 has been conducting cyberespionage operations since 2006. The cyberespionage operation affected or targeted at least 141 organizations across 20 major industries – ranging from IT and Transporation to Engineering Services and Chemicals – primarily in English-speaking countries, including the U.S. (115 multinationals), India (3), Singapore (2). Possibly linked to the ShadyRAT campaign, which McAfee discovered in 2011, the campaign may have also affected India, Indonesia, Vietnam, Japan, Denmark, and Germany. Given that the largest targets of cyberespionage were private entities, it is very much possible that the APT has stolen vast amounts of commercial secrets that relate to multiple sets of economic sectors and industries.

The perpetrator was suspected to be APT1 and ShadyRAT, two possible sets of hacking groups that may have some affiliations with the Second Bureau of the Third Department of PLA’s General Staff Department.
‍
There was a rise in attacks after 2010. Of note, 13 out of 16 IT organizations attacked are from 2010-2012. Most incidents across the board also seem to occur after 2010. It may be closely tied to the 12th Five-Year Plan (2011-2015), which is a cyclical strategy document by the CPC leadership that steers the general direction of economic initiatives: namely next-generation information technology, high-end equipment manufacturing, alternative energy, and new materials. Fundamentally, in launch occurred not long after the 2006 National Medium- and Long-Term Plan For the Development of Science and Technology, China laid out its goals to reduce its dependence on the West for advanced technologies, and on the U.S. and Japan in particular.

Mandiant; McAffee

The U.S. Department of Justice indicted five Chinese military officers associated with this hack.

High Confidence (9 out of 12)

• Private entities are a majority of known sectors targeted in the intrusion (2 points)
• Commercial data are known to be the dominant targets of intrusion (3 points)
• APT actor has some history of stealing IP and other commercially valuable data (2 points)
• No concrete evidence that data stolen was used to aid domestic private businesses of malign state, but data stolen likely aligns with malign state's industrial policies (2 points)

From January 2020 until 2021, cybersecurity firms detected a massive cyberespionage campaign targeting private entities. These campaigns were conducted in three clusters. First, from January to March 2020, there was a broad campaign against 75 private entities in 20 countries, with a focus on industries ranging from petrochemicals to defense industrial base. Mandiant notes that while it’s unclear if APT41 scanned the Internet and attempted exploitation en masse or selected a subset of specific organizations to target, the victims appear to be more targeted in nature. The economies affected were Australia, Canada, Denmark, Finland, France, India, Italy, Japan, Malaysia, Mexico, Philippines, Poland, Qatar, Saudi Arabia, Singapore, Sweden, Switzerland, UAE, UK and USA.

Second, in September 2020, hackers associated with APT41 were charged by the U.S. Department of Justice in connection with computer intrusion campaigns against more than 100 victims globally, including in Indonesia, Malaysia, Thailand, and Vietnam. The entities affected were those that specialize in software development, manufacturers, telecommunications, non-profit, universities, and civil society organizations.

Third, from July 2020 until August 2021 (ongoing as of then), Trend Micro observed an espionage campaign against victims in India, m, Malaysia, Philippines, Taiwan, and Vietnam in the airline, computer hardware, automotive, infrastructure, publishing, media, and IT industries.

US Government, Mandiant; Trend Micro

In second incident, U.S. Department of Justice indicts seven individuals (two arrested, five remaining)

High Confidence (9 out of 12)

• Private entities are a majority of known sectors targeted in the intrusion (2 points)
• Commercial data are likely to have been targeted (2 points)
• APT actor is strongly associated with economic espionage operations, with motivations strongly tied to certain states’ industrial policy objectives (3 points)
• No concrete evidence that data stolen was used to aid domestic private businesses of malign state, but data stolen likely aligns with malign state’s industrial policies (2 points)

Nicknamed Operation Diànxùn by the McAffee Advant Threat Research (ATR) Strategic Intelligence team, this cyberespionage campaign likely targeted people working in the telecommunications industry to access sensitive data and to spy on companies related to 5G technology. The first activity was observed to have taken place in August 2020, with several private entities suffering a cyber intrusion when the hackers leveraged a fake Huawei careers website to lure telecom employees and infect their systems with info stealers.

The McAfee ATR team holds with a moderate level of confidence that the motivation behind this specific campaign had to do with the banning of Chinese technology from the construction of telecoms network across the world. The countries outside of Southeast Asia – U.S., Spain, Germany, Austria, Czechia, and Ukraine – targeted were all signatories to a global security agreement for future 5G networks, highlighting concerns about equipment supplied by vendors that might be subject to state influence. Vietnam, meanwhile, is opting to avoid Huawei technology and instead moving to develop its own 5G technology.

McAfee ATR had attributed the hacking operations to two threat actors: RedDelta and Mustang Panda. Meanwhile, Mustang Panda has had a history of conducting cyberespionage operations on behalf of the Chinese state to steal information that align with China’s “Made in China 2025” goals and BRI plans. Thus, there is past precedence for their support in the pursuit of industrial goals.

McAffee Advant Threat Research

None

High Confidence (10 out of 12)

• Private entities are either the sole or the primary targets of intrusion (3 points)
• Commercial data are known to be the dominant targets of intrusion (3 points)
• APT actor has some history of stealing IP and other commercially valuable data (2 points)
• No concrete evidence that data stolen was used to aid domestic private businesses of malign state, but data stolen likely aligns with malign state's industrial policies (2 points)