Menu
Second Chinese army unit linked to corporate cyber-espionage

Second Chinese army unit linked to corporate cyber-espionage

Internet postings link a Chinese hacking group to a military unit

A Chinese hacking group that has attacked U.S. and European aerospace and communications companies is almost certainly linked to the Chinese military, a U.S. Internet security company said Monday.

"Putter Panda" has been active for several years, and a trail of Internet postings and domain registrations by one of its members points to it being part of Unit 61486 of China's People's Liberation Army, said Irvine, California-based CrowdStrike in a 62-page report.

The unit is different from the one recently named by the U.S. Department of Justice in a series of indictments of Chinese citizens.

CrowdStrike said the link between the attacks and the Chinese army was established through a number of Internet postings, photo uploads and domain registrations made by one of the group's members.

The same name, Chen Ping, or associated email addresses and aliases were used to register a number of domain names that were used to host malware or control hacking tools. Some contain the names of major Japanese gaming companies, such as Konami and Namco, while others mention Kyocera, BMW and Nestle. There's also one named "Windows Updote," an easily missed incorrect spelling of Microsoft's Windows Update.

Accounts on websites and blogs pointed to Chen living in Shanghai and having an interest in Internet security. In one photo uploaded after a drinking session with friends, two PLA officers' peaked caps can be seen in the background.

Another picture posted by Chen from "the office" shows several large satellite dishes on the grounds of the building's compound. The dishes have been located at a Shanghai building known to house a PLA signals intelligence unit. As if to make the link clearer, Chen at one point registered one of his domain names to the building's address.

"When you look at operational security of some of the folks involved in this high-profile cyber-espionage, you would think they would be a little more careful about how they operate," said George Kurtz, president and CEO of CrowdStrike.

But despite its poor operational security, Unit 61486 is a determined adversary, the report said.

"They are roughly equivalent to the other actors we've seen coming out of China," said Adam Meyers, CrowdStrike's vice president of intelligence. "They've got a whole bunch of custom stuff they have built, a lot of different tools, and they have some degree of capability."

In late May, the U.S. Department of Justice indicted five Chinese nationals on charges of hacking U.S. companies to obtain trade secrets. It was the first time the U.S. had formally indicted state-sponsored hackers.

The Chinese government denied the claims and called them "fabricated," and in a subsequent report the government said it was a victim of U.S. cyberattacks.

That response was part of the motivation for CrowdStrike's new report, Kurtz said.

"We see a lot on the ground, where we see first hand the intellectual property theft taking place," he said. "We really wanted to put this story out there to say it isn't a one-off in terms of the U.S. government's indictments. It's a sustained, coordinated and systematic campaign against companies around the globe."

Martyn Williams covers mobile telecoms, Silicon Valley and general technology breaking news for The IDG News Service. Follow Martyn on Twitter at @martyn_williams. Martyn's e-mail address is martyn_williams@idg.com

Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Tags CrowdStrikeintrusionsecurityspyware

Featured

Slideshows

Reseller News launches inaugural Hall of Fame lunch

Reseller News launches inaugural Hall of Fame lunch

Reseller News welcomed 2015 and 2016 inductees - Darryl Swann, Dave Rosenberg, Gary Bigwood, Keith Watson, Mike Hill and Scott Green - to the inaugural Reseller News Hall of Fame lunch, held at the French Cafe in Auckland. The inductees discussed how the channel can collectively work together to benefit New Zealand, the Kiwi skills shortage and the future of the industry. Photos by Maria Stefina.

Reseller News launches inaugural Hall of Fame lunch
Educating from the epicentre - Why distributors are the pulse checkers of the channel

Educating from the epicentre - Why distributors are the pulse checkers of the channel

​As the channel changes and industry voices deepen, the need for clarity and insight heightens. Market misconceptions talk of an “under pressure” distribution space, with competitors in that fateful “race for relevance” across New Zealand. Amidst the cliched assumptions however, distribution is once again showing its strength, as a force to be listened to, rather than questioned. Traditionally, the role was born out of a need for vendors and resellers to find one another, acting as a bridge between the testing lab and the marketplace. Yet despite new technologies and business approaches shaking the channel to its very core, distributors remain tied to the epicentre - providing the voice of reason amidst a seismic industry shift. In looking across both sides of the vendor and partner fences, the middle concept of the three-tier chain remains centrally placed to understand the metrics of two differing worlds, as the continual pulse checkers of the local channel. This exclusive Reseller News Roundtable, in association with Dicker Data and rhipe, examined the pivotal role of distribution in understanding the health of the channel, educating from the epicentre as the market transforms at a rapid rate.

Educating from the epicentre - Why distributors are the pulse checkers of the channel
Kiwi channel reunites as After Hours kicks off 2017

Kiwi channel reunites as After Hours kicks off 2017

After Hours made a welcome return to the channel social calendar last night, with a bumper crowd of distributors, vendors and resellers descending on The Jefferson in Auckland to kickstart 2017. Photos by Maria Stefina.

Kiwi channel reunites as After Hours kicks off 2017
Show Comments