The US has charged two Chinese nationals for hacking into hundreds of companies over the past decade in an effort to steal trade secrets for China.
On Tuesday, the Justice Department unsealed an indictment against the two suspects—34-year-old Li Xiaoyu and 33-year-old Dong Jiazhi—who federal investigators claim actually work for China’s intelligence service, the Ministry of State Security (MSS).
For the past decade, the suspects have been trying to steal confidential plans from across the private sector, most recently research on COVID-19 vaccines and treatments. “China is using cyber-enabled theft as part of a global campaign to ‘rob, replicate, and replace’ non-Chinese companies in the global marketplace,” Assistant Attorney General John Demers said in today’s announcement.
According to the indictment, Li and Dong were classmates at an electrical engineering college in Chengdu, China, who began their hacking activities in 2009. They stole terabytes of data from hundreds of targets, which include high-technology industries in the US, Germany, Japan, South Korea, and the UK, among others.
(Credit: Justice Department)
The indictment claims Li and Dong looted “hundreds of millions of dollars” in trade secrets. Victim companies focused on fields such as medical devices, solar power, industrial engineering, defense, and robotics.
(Credit: Justice Department)
By stealing the intellectual property, the suspects help China’s homegrown industries save on R&D costs and gain a competitive edge. Federal investigators also claim the suspects broke into online accounts belonging to activists and human rights groups. “For example, they provided the MSS with email accounts and passwords belonging to a Hong Kong community organizer, the pastor of a Christian church in Xi’an, and a dissident and former Tiananmen Square protestor,” the indictment claims.
In other cases, the hackers broke into victim companies for their own personal profit. Li, for example, allegedly stole source code from one victim and threatened to publish it unless he was paid $15,000 in cryptocurrency.
The suspected hackers pulled off their attacks by exploiting publicly known vulnerabilities in software devoted to web servers, web application development, and software collaboration. “In some cases, those vulnerabilities were newly announced, meaning that many users would not have installed patches to correct the vulnerability,” the Justice Department said.
The hackers also had knowledge of at least one zero-day vulnerability in a popular internet browser, which was supplied by an unnamed MSS officer. The hackers then used the vulnerability to attack a Burmese human rights group.
Once access to a victim’s network was achieved, the hackers would plant variants of a malware strain, called China Chopper, which can execute commands and also steal login credentials. The data was then stolen by packaging the information in encrypted RAR files, which were often placed in victim computers’ recycle bin for later extraction.
According to the Justice Department, both suspects are residents of China, which is unlikely to extradite them to the US. However, federal officials are hoping that naming and shaming the suspects will convince other state-sponsored hackers to abandon their jobs and try a different line of work.
“China’s anti-competitive behavior and flagrant disregard for their promises not to engage in cyber-enabled intellectual property theft is not just a domestic issue; it is a global issue,” Demers added.
How the US linked the hacking crimes to Li and Dong was left unsaid, but the indictment indicates that federal investigators have been monitoring the duo’s activities, including their contacts with Chinese intelligence officers. The Chinese government has routinely denied sponsoring any hacking activities.
