China Hacker Groups Launching Waves of Cyberattacks against THAAD

By Arthur Dominic J. Villasanta , | April 22, 2017

FBI poster naming Chinese hackers accused of cyber espionage against the U.S.

FBI poster naming Chinese hackers accused of cyber espionage against the U.S.

China's notorious state-sponsored hackers are trying -- and are so far failing -- to hack into South Korean governmental, military and defense organizations vital to the deployment of the U.S. Terminal High Altitude Area Defense (THAAD) missile system to be installed in South Korea in the next few months.

Like Us on Facebook

American cybersecurity firm FireEye, Inc said Chinese state hackers are launching more and more cyberattacks against South Korean institutions having to do with THAAD.

FireEye said these attacks originate from mainland China. The attacks included a denial of service attack (DoS) against the website of South Korea's Ministry of Foreign Affairs; "spear-phishing," which is the espionage tactic of sending emails ostensibly from a known or trusted sender to induce targeted individuals to reveal confidential information and "watering hole" attacks that infect with malware one or more websites known to be frequented by targets of the cyberattacks.

FireEye has detected a large spike in attacks against South Korean targets from China since February, which is when South Korea announced its decision to deploy THAAD to protect itself against a possible North Korean ballistic missile attack.

The cyberattacks have focused on organizations associated with the THAAD deployment, said John Hultquist, FireEye's director of cyber-espionage analysis.

FireEye said it's found evidence the attacks are being launched by two groups connected to the People's Liberation Army (PLA).

One of these PLA cyber espionage groups, dubbed "Tonto Team" by FireEye, operates from the same region of China from which previous North Korean hacking operations originated.

The other group, APT10 or "Stone Panda," is the same group believed to be behind recent cyber attacks against U.S. companies lobbying the Trump administration on global trade.

These groups have also been joined in attacks by two "patriotic hacking" groups. One of these freelance hacking groups called "Denounce Lotte Group" is going after the South Korean conglomerate Lotte. Lotte provided the land on which the THAAD missile system will be based.

There's no information if North Korea's infamous hacking group, Bureau 121 based in the Moonshin-dong area of Pyongyang, is involved in these attacks. Bureau 121 is believed responsible for the hack of Sony Pictures Entertainment in California in November 2014.

©2024 Telegiz All rights reserved. Do not reproduce without permission
Real Time Analytics