Chinese Firm Sanctioned For Potentially Lethal Cyber Attacks
A Chinese cyber security firm and one of its researchers have been sanctioned by the US for a cyber attack that tried to exploit a computer software vulnerability in company firewalls, potentially resulting in killing people by system malfunctions, the US Treasury Department has said.
A federal court in Indiana, unsealed an indictment is charging Guan Tianfeng, a citizen of the People’s Republic of China (PRC) for his involvement in a conspiracy to carry out a wide-ranging hacking campaign to penetrate firewall devices worldwide in 2020.
Guan and his co-conspirators worked at the offices of Sichuan Silence Information Technology company with the aim to discover and exploit a previously-unknown Zero-Day vulnerability in certain firewall tools sold by the leading UK cyber security firm, Sophos.
An employee of Sichuan Silence Information Technology Company, Guan Tianfeng, deployed malicious software to more than 80,000 firewalls run by thousands of companies worldwide in April 2020, including 23,000 in the US.
Sichuan Silence is a cyber security government contractor located in the city of Chengdu in central China whose main clients are Chinese government intelligence services, the Treasury Department said. “Sichuan Silence provides these clients with computer network exploitation, email monitoring, brute-force password cracking, and public sentiment suppression products and services.”
The sanctions follow a series of alleged Chinese cyber espionage activities in the US in which government agencies have accused hackers from China of stealing the metadata of a large number of Americans in a wide-ranging campaign that has targeted at least eight US telecom firms, as well as dozens of other countries in a campaign carried out bu a nation-state hacking group know as Salt Typhoon.
- In September, the FBI also said it had uncovered another far-reaching Chinese hacking campaign that is has named Flax Typhoon.
- In November, US government authorities said they had found hacks carried out by Salt Typhoon, that targeted multiple telecommunications companies aiming to steal information from Americans working in government and politics.
In the latest case involving Sichuan Silence, the malware was allegedly designed to steal data, including usernames and passwords, as well as deploy ransomware that blocks access to victims’ computer networks using encryption when companies try to fix the attacks.
Of the 23,000 firewalls in the US, 36 were protecting the systems of critical infrastructure companies, the Treasury Department said. If any of the targets had failed to sufficiently protect their systems or quickly detect the ransomware attack, the potential impact “could have resulted in serious injury or the loss of human life”. One of the victims was a US energy company that was actively involved in drilling operations at the time of the incident, potentially causing oil rigs to malfunction and “causing a significant loss in human life”.
The sanctions effectively block any assets of Sichuan Silence and Guan in the US, and usually ban US banks, companies or individuals from doing business with them.
Sichuan Silence has previously been accused of involvement in cyber attacks. In 2021, Meta Platforms, the parent company of Facebook and Instagram, alleged that the firm was linked to an online disinformation network spreading the claims of a fake Swiss biologist who alleged the US was meddling in efforts to find the origins of COVID.
The sanctions on Guan and Sichuan Silence are part of a larger government effort to address widespread concerns about China’s infiltration of widely-used edge computing devices, including firewalls, VPN services and routers.
The US Department of Justice has recently published an indictment on Guan for his role in the cyber attack, and the US Department of State is offering $10m reward for information about Sichuan Silence or Guan.
US Dept. of Justice | US Sate Dept. | US Treasury Dept | Reuters | AlJazeera | Times of India |
Image: Andbreit
You Might Also Read:
Trump 2.0: Cyberwarfare To Reach New Heights:
If you like this website and use the comprehensive 7,000-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.
- Individual £5 per month or £50 per year. Sign Up
- Multi-User, Corporate & Library Accounts Available on Request
- Inquiries: Contact Cyber Security Intelligence
Cyber Security Intelligence: Captured Organised & Accessible
