U.S. charges 3 Chinese with hacking but stops short of blaming Beijing directly

[nitpicker]

http://www.mcclatchydc.com/news/nation-world/national/national-security/article186774098.html

U.S. charges 3 Chinese with hacking but stops short of blaming Beijing directly

By Tim Johnson

[e-mail]

November 27, 2017 06:17 PM

WASHINGTON — A federal grand jury in Pittsburgh charged three Chinese nationals with hacking and theft of trade secrets Monday for allegedly stealing data from corporate networks in the United States, a move that may become an irritant in U.S.-China relations in other areas. The three indicted individuals are employees of a cybersecurity firm in Guangzhou, a metropolis in southern China, and work closely with China’s Ministry of State Security.

The alleged hacking began in 2011 and continued until May of this year, according to the indictment. Three companies fell victim to the intrusions, including Moody’s Analytics, a major economic analysis firm. The others were Siemens AG, a German manufacturing and electronics conglomerate with U.S. operations, and Trimble Inc., a Sunnyvale, Calif., firm that provides specialized GPS technology, the document said.

The indictment shied from directly linking the Chinese government to the hacking, blaming only the private company, Guangzhou Bo Yu Information Technology Co. But a researcher at a U.S. cyber threat intelligence company, Recorded Future, said the Chinese company, called Boyusec for short, is a front operation for the Ministry of State Security and the indicted individuals are intelligence agents.
(snip)

The indictment said the three Chinese nationals -- Wu Yingzhuo, Dong Hao and Xia Lei – sought to steal commercial secrets and sensitive employee data by sending spearphishing e-mails to employees with malicious attachments or links to malware that facilitated access to the recipient’s computer. Then the hackers would install other tools on victims’ computers, sometimes using intermediary servers known as “hop points,” the indictment added. There was no immediate reaction from the individuals charged or the company that employs them.

[nitpicker]

1. From the DoJ PR

https://www.justice.gov/opa/pr/us-charges-three-chinese-hackers-who-work-internet-security-firm-hacking-three-corporations

(snip)
In 2015 and 2016, Trimble was developing a Global Navigation Satellite Systems technology designed to improve the accuracy of location data on mobile devices. In January 2016, while this project was in development, Wu accessed Trimble’s network and stole files containing commercial business documents and data pertaining to the technology, including Trimble trade secrets. In total, between December 2015 and March 2016, Wu and the other co-conspirators stole at least 275 megabytes of data, including compressed data, which included hundreds of files that would have assisted a Trimble competitor in developing, providing and marketing a similar product without incurring millions of dollars in research and development costs.

In 2014, Dong accessed Siemens’s computer networks for the purpose of obtaining and using employees’ usernames and passwords in order to access Siemens’ network. In 2015, the co-conspirators stole approximately 407 gigabytes of proprietary commercial data pertaining to Siemens’s energy, technology and transportation businesses.

In or around 2011, the co-conspirators accessed the internal email server of Moody’s Analytics and placed a forwarding rule in the email account of a prominent employee. The rule directed all emails to and from the employee’s account to be forwarded to web-based email accounts controlled by the conspirators. In 2013 and 2014, defendant Xia regularly accessed those web-based email accounts to access the employee’s stolen emails, which contained proprietary and confidential economic analyses, findings and opinions.
(snip)