China Has “taken the gloves off” In Hacking Attacks

Remember the good old days, when the US and China were supposedly working out new norms for cyber, and China was going to stop all that hacking of US companies to steal intellectual property? 
 
It turns out the Chinese were just upping their hacking game, improving their operational security and penetration skills, learning from the methods of their Russian counterparts.
 
A recent example of that "island hopping" tactic is the "Cloud Hopper" hacking campaign, active since at least May of 2016. In October the US Dept. of Homeland Security (DHS) issued a new alert on the campaign, warning of a surge in activity by the campaign over the past few months. Cloud Hopper has been attributed to the threat group known as APT 10, aka Stone Panda—a hacking group that has been tied to the Chinese Ministry of State Security's Tianjin Bureau.
 
Based on data from incident response companies gathered by the security firm Carbon Black, China is now the leading source of cyber-attacks. Of 113 investigations conducted by Carbon Black's incident response partners in the third quarter of 2018, nearly half, 47 in total, came from China or Russia.
 
"What was notable was that we saw a resurgence of Chinese attacks, where they actually surpassed Russian activity," said Carbon Black's chief cybersecurity officer, Tom Kellermann. "And I think that's in direct line with the increasing tension with the South China Sea coupled with the trade war. Essentially, the Chinese have taken the gloves off."
 
The data backing this analysis, part of a report released recently by Carbon Black, came from 37 incident-response firms that partnered with the company. It's the second quarterly report compiled from incident-response data and an attempt by the intrusion-response community to understand more about the behavior of attackers, and how they manage to spend so much time within networks before they are detected.
 
"The Verizon data-breach report, which we all appreciate as being probably the best report out on data breaches, always failed to explain why [dwell time] was over 130 days," Kellermann told Ars. That Verizon report "talked about the vector and some of the weaknesses in security but never described why that dwell time was so expansive. 
 
This report is specifically trying to drive out how are they getting in, how are they staying in, how are they moving laterally, how are they changing, and are they becoming more punitive."
 
And, in fact, attackers on the whole do appear to be turning more "punitive", engaging in more destructive behavior either as part of a deliberate sabotage campaign or to counter the efforts by victims of intrusions to respond to them. 
 
But as far as the Chinese attackers go, it's clear that they have also significantly upped their game, improving their stealth and tactics in a way that has allowed them to dig deeper into targets and stay longer than before.
 
"They're doing a much better job of operational security for their campaigns and doing a tremendous amount of 'island hopping', targeting the major service providers and corporations' brands in order to island hop into their constituencies," Kellermann explained.
 
This type of stealth is a significant departure from Chinese state-sponsored hacking operations in the past. "The joke used to be that when the Chinese would come after you, they would throw the kitchen sink at you, and inevitably they would get into your house, and it would sound like a bunch of drunks in your kitchen at night," Kellermann said. "The Russians, if they targeted you. You would just wake up feeling funny in the morning."
 
But now, the Chinese groups are mirroring some of the clandestine techniques used by the Russian underground and "cyber militias," including:
 
• Using multiple command and control (C&C) systems to communicate with backdoors and other malware, with at least one of them on a "sleep cycle", left inactive until after other C&C systems have been purged by the targeted organisation's security team.
 
• "Living off the land" and moving within the targeted network by using 'known good tools' (legitimate software packages or system tools that may already be installed on the target network, such as PowerShell).
 
• Using techniques such as process hollowing to conceal malicious code within an existing system process to evade detection, Windows Management Instrumentation, and other alternatives to PowerShell to conceal activity on Windows systems.
 
Chinese hacking groups aren't the only ones to have improved their game against intrusion detection and response. Attackers from Iran, North Korea, and Brazil have also been evolving their behavior to adjust to the widespread use of breach-detection tools and common intrusion-response practices. The data gathered for the report showed that more than 40 percent of the incident-response investigations in the last three months found a secondary command and control network in place "on the sleep cycle." And more than 50 percent of the incidents were cases where the victim was not the primary target of the attack.
 
That said, the resurgence of the Chinese attacks is concerning when combined with their shift in tactics. While Chinese attacks against US targets never really stopped after the 2015 agreement on cyber norms, they had become much less brazen, which Kellermann attributes to their realization that they were "terrible at operational security." 
 
But they may have refocused their activities elsewhere, targeting India, Japan, and South Korea, as they learned more about how companies defended themselves and responded to breaches.
 
Bringing the Pain
 
Across the board, the financial sector was the most commonly targeted victim, followed by healthcare. "With North Korea and Iran, as well as Russia, they're understanding how they can offset economic sanctions by targeting the financial sector," Kellerman suggested.
 
But there was also a spike over the third quarter of 2018 in attacks against manufacturing companies, a type of attack that has been frequently tied to Chinese economic espionage. 
 
"Hacking a manufacturing entity, it's very hard to create a liquid asset to capitalise financially on that," Kellermann noted, "unless it's for the purpose of economic espionage or economic sabotage."
 
There was another spike that drew notice, a shift toward what Kellermann described as "a more punitive adversary." In 32 percent of the documented investigations over the past quarter, the attackers engaged in some sort of data destruction, either as economic sabotage or as a way of countering incident-response efforts by the victim.
 
"We're seeing destruction of logs, not just the logs specific to the footprint of the adversary on various hosts, but just massive amounts of logs," Kellermann said, "and that should be concerning to all of us. In the first three months we looked at, back in the spring of this year, we were at 10 percent for destructive attacks. Now we're at 32 percent. Is it the geopolitical context, or is it just that the actors have become far more punitive?"
 
The trend suggests, Kellermann said, that the days of "the straight burglary" of data are now gone, and sophisticated attackers are turning toward the tactics of a home invasion. 
 
Kellermann compared most companies' tactics in dealing with intrusions to responding to an intruder by "standing at the top of the steps and shouting 'I've got a gun and the police know you're here' and assuming that would scare them away." 
 
The problem with that approach, he noted, was that it assumes that there is only one intruder, that the threat is enough to intimidate them to leave, and that the intruder(s) "would not get punitive enough to come upstairs and set the house on fire."
 
We've already seen the potential threat of purely destructive attacks in the past from malware such as Shamoon, WannaCry, and NotPetya. 
 
But as tensions continue to build over trade, that sort of virtual arson attack on networks could become increasingly more common and much more sophisticated in its application. And that's something that current security practices and US "cyber deterrence" don't yet appear to be prepared to deal with.
 
Ars Technica:
 
You Might Also Read:
 
China Is 'biggest state sponsor of Cyber-Attacks on the West'
« China May Be Reading Your Emails
How Did Iran Find CIA Spies? They Googled It! »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

Caliber Security Partners

Caliber Security Partners

Caliber Security Partners is a full-service information security company, with a wide range of security services for clients with varying levels of security maturity.

Red Hat

Red Hat

Red Hat is a leader in open source software development. Our software security team proactively identifies weaknesses before they become problems.

Agenci

Agenci

Agenci are specialists in cyber security and information security and deliver ISO 27001 Certification.

North American Electric Reliability Corporation (NERC)

North American Electric Reliability Corporation (NERC)

NERC is a not-for-profit international regulatory authority whose mission is to assure the reliability and security of the bulk power system in North America.

Advanced Software Products Group (ASPG)

Advanced Software Products Group (ASPG)

ASPG offers a wide range of innovative mainframe software solutions for Data Security, Access Management, System Management and CICS productivity.

Swascan

Swascan

Swascan is the first all-in-one, GDPR Compliant, Cloud Security Suite Platform. GDPR Assessment, Web Application Scan, Network Scan, Code Review.

Leadcomm

Leadcomm

Leadcomm is a Brazilian company focused on the distribution and integration of IT systems and security solutions for large companies.

Wipe-Global

Wipe-Global

Wipe-Global is specialized in data erasure with an international established service partner network.

Finosec

Finosec

Finosec's mission is to change the way information security and cybersecurity are managed in banking.

CleanCloud by SEK

CleanCloud by SEK

CleanCloud by SEK is a CSPM product focused on public cloud data protection and security regulations, with over 400 compliance checks for the market's leading frameworks and regulations.

Palmchip

Palmchip

Palmchip is a Cyber Security, SOC and Software consulting company. We design and develop high performance and secure applications.

Acora

Acora

Acora provide a range of best-in-class managed services, Microsoft-centric business software, and cloud solutions designed to help mid-market organisations succeed in the digital economy.

DC Two

DC Two

DC Two are a locally operated and supported Australian data centre, offering a suite of vertically integrated services covering every part of the data centre and cloud technology stack.

Hetz Ventures

Hetz Ventures

Hetz Ventures is a global-facing VC investing in highly talented and ambitious Israeli founders who operate at the cutting edge of deep technology.

Reco AI

Reco AI

Reco is an identity-centric SaaS security solution that empowers organizations with full visibility into every app, identity, and their actions to control risk in their SaaS ecosystem.

Chorology

Chorology

Chorology is a leading provider of intelligently automated, data compliance and posture enforcement solutions.