The Department of Justice unsealed an indictment in July detailing the exploits of a Chinese hacking group.

President Xi Jinping was embarrassed by revelations of the People’s Liberation Army’s hacking activities and gave more responsibility to the Ministry of State Security.

China has changed its tactics since cyberhacking responsibilities were transfered to the Ministry of State Security from the People’s Liberation Army.

Spionage

:

So hackt China

Geleakte Dokumente zeigen, wie die chinesische Regierung mit privaten Firmen zusammenarbeitet. Im Visier der Hacker: Regierungen, Infrastruktur und Social Media

Von Eike Kühl

12 Kommentare

Artikel hören

0.5x                 0.75x                 1x                 1.25x                 1.5x                 2x

Spionage: Das Gebäude von I-Soon in Chengdu im südwestlichen China. Dokumente der Firma verraten viel über die Hacking-Interessen des Landes.

Das Gebäude von I-Soon in Chengdu im südwestlichen China. Dokumente der Firma verraten viel über die Hacking-Interessen des Landes. © ZEIT ONLINE; Dake Kang/AP/dpa

So hackt China – Seite 1

Am 15. Januar registrierte jemand die verschlüsselte E-Mail-Adresse I-SOON@proton.me. Einen Monat später, am 16. Februar, begann die Person damit, rund 570, größtenteils chinesischsprachige Dateien auf die Softwareplattform GitHub zu laden. Wer hinter dem Account steckt, ist nicht bekannt. Wo die Daten herkommen, scheint aber inzwischen so gut wie sicher zu sein: Es handelt sich sehr wahrscheinlich um geleakte Dokumente des chinesischen IT-Sicherheitsunternehmens I-Soon (Auxun). Und sie geben einen Einblick, wie die chinesische Regierung mithilfe privater Firmen und Hackergruppen Ziele im In- und Ausland angreift.

Zwei Mitarbeiter von I-Soon haben gegenüber der Nachrichtenagentur Associated Press offenbar die Authentizität der Dokumente bestätigt. Den Personen zufolge untersuchen I-Soon und die chinesische Polizei derzeit gemeinsam, wie es zu dem Leak gekommen ist. Das Tagesgeschäft von I-Soon sei davon nicht beeinträchtigt.

:

Kaspersky

:

Mit unsichtbaren Textnachrichten Handys gehackt

Die zahlreichen geleakten Marketingmaterialen, technischen Berichte und Chatverläufe von I-Soon-Angestellten und Kunden zeigen die engen Verbindungen zwischen dem semi-privaten Sicherheitssektor und der staatlichen Hackerszene in China. I-Soon, das seine Firmenzentrale in Shanghai hat, beschreibt sich auf seiner Website als Anbieter "digitaler Sicherheitslösungen", die sowohl Angriff als auch Verteidigung umfassen. Zu den Kunden und Sponsoren gehören laut der Associated Press auch das chinesische Ministerium für öffentliche Sicherheit und die Volksbefreiungsarmee.

Straßendaten aus Taiwan, Telefondaten aus Südkorea

Ein Vertragsentwurf in den Dokumenten soll zeigen, wie I-Soon die Polizei von Xinjiang bei "Anti-Terror-Projekten" unterstützen könnte. Xinjiang ist die Region, in der die Minderheit der Uiguren von der chinesischen Regierung gewaltsam unterdrückt wird. I-Soon behauptet, man habe Zugriff auf gehackte Flug- und Mobilfunkdaten, um Uiguren aufzuspüren.

An anderer Stelle ist von einem Tool die Rede, das mutmaßlich E-Mail-Adressen und Telefonnummern von X-Nutzern herausfinden kann, sodass diese identifiziert werden könnten, falls sie sich regimekritisch äußern. Eine knapp 460 Gigabyte große Datenbank soll detaillierte Angaben über das Straßennetzwerk in Taiwan enthalten, was im Fall eines Angriffs Chinas auf Taiwan nützlich sein könnte.

Newsletter

Natürlich intelligent

Künstliche Intelligenz ist die wichtigste Technologie unserer Zeit. Aber auch ein riesiger Hype. Wie man echte Durchbrüche von hohlen Versprechungen unterscheidet, lesen Sie in unserem neuen KI-Newsletter.

Mit Ihrer Registrierung nehmen Sie die Datenschutzerklärung zur Kenntnis.

Die Dokumente erwähnen aber nicht nur Angriffe im Inland, sondern auch auf ausländische Ziele, vor allem, aber nicht ausschließlich in Asien. So gehörten mutmaßlich zehn thailändische Regierungsbehörden, darunter das Außenministerium und der Geheimdienst, zu den potenziellen Zielen der I-Soon-Hacker. Umgerechnet 55.000 US-Dollar soll ein Angriff auf das vietnamesische Wirtschaftsministerium gekostet haben. In Indien wurden mutmaßlich 95 Gigabyte Einwanderungsdaten abgegriffen, in Südkorea drei Terabyte an Telefonverbindungen.

Auch potenzielle Ziele in westlichen Ländern kommen vor, darunter das britische Finanzministerium und die Thinktanks Chatham House und das International Institute for Strategic Studies. Ob und welche Nato-Mitgliedsstaaten erfolgreich gehackt wurden, geht aus den Dokumenten offenbar nicht hervor; einer Untersuchung der Washington Post zufolge wird in einem geleakten Chatverlauf lediglich angedeutet, dass man im Jahr 2022 nicht weiter genannte Nato-Daten verkauft habe.

Nicht zuletzt erwähnen die Dokumente die technischen Fertigkeiten von I-Soon. Das Unternehmen will über eine Technologie verfügen, mit der sich Outlook-E-Mail-Konten knacken und Windows- und Mac-Rechner steuern lassen. Konkrete Sicherheitslücken werden allerdings nicht erwähnt. Im Juli vergangenen Jahres meldete Microsoft einen mutmaßlich chinesischen Hackerangriff auf E-Mail-Konten mit Verbindungen zu Regierungsbehörden in Westeuropa. Ob dieser im Zusammenhang mit I-Soon steht, ist unklar.

Wie das IT-Sicherheitsunternehmen Sentinel Labs in einer kurzen Analyse schreibt, sollen technische Dokumente potenziellen Käuferinnen zeigen, "wie die Produkte des Unternehmens dazu dienen, Ziele zu kompromittieren und auszunutzen". Fotos zeigen eine präparierte Powerbank, die dazu genutzt wurde, um unbemerkt Daten eines Computers abzugreifen. "Obwohl es sich hierbei nicht um überraschende oder ausgefallene Fähigkeiten handelte, bestätigten sie, dass die Haupteinnahmequelle des Unternehmens Hacken-gegen-Bezahlung und Angriffsfunktionen sind", schreiben die Experten von Sentinel Labs.

Chinesische Hacker beschweren sich über schlechte Bezahlung

In den geleakten Chatverläufen zeigt sich aber auch ein gewisser Unmut unter den Mitarbeiterinnen und Mitarbeiterinnen und Kunden des Unternehmens. Ein Kunde soll sich über die Qualität der gehackten Regierungsdaten beschwert haben, wie die Washington Post schreibt. An anderer Stelle kritisierten Angestellte von I-Soon lange Arbeitszeiten, Sexismus und schlechte Bezahlung. Und wieder an anderer Stelle wird ein Gerichtsverfahren über ausstehende Zahlungen zwischen I-Soon und dem Unternehmen Chengdu 404 erwähnt, das wiederum eng mit der staatlichen Hackergruppe APT41 in Verbindung stehen soll.

"Es scheint so etwas wie eine sehr umkämpfte Industrie entstanden zu sein, wenn es darum geht, ausländische Regierungssysteme zu hacken. I-Soon ist nur einer von vielen Akteuren", schreibt der bekannte IT-Sicherheitsforscher Brian Krebs.

Das deckt sich mit anderen Einschätzungen, wonach die chinesische Regierung in den vergangenen Jahren verstärkt auf private Firmen setzt, um Ziele im In- und Ausland auszuspionieren. Dadurch kann China zwar seine Cyberangriffe intensivieren und durch mehr Bedrohungen für mehr Chaos sorgen. Gleichzeitig nimmt die Regierung in Kauf, dass die angeheuerten Hacker eigene Interessen verfolgen und dabei unter Umständen etwas plump vorgehen. "Diese neue Gruppe von Hackern macht Chinas staatliche Cyberspionagemaschine stärker und ausgefeilter, aber angesichts der wachsenden Zahl staatlicher und privater Ziele auch gefährlicher und unberechenbar", schrieb die New York Times im Sommer 2021.

Wie unberechenbar, zeigen letztlich die aktuellen Leaks. Ob dahinter nun ein unzufriedener Mitarbeiter von I-Soon steckt oder eine rivalisierende Hackergruppe: Die Dokumente werfen Licht auf eine Szene, die nur allzu gerne im Dunkeln bleiben möchte. Auch wenn die Dokumente, soweit sich das bislang sagen lässt, keine bahnbrechende neue Erkenntnis oder Hinweise auf besonders perfide Angriffsmöglichkeiten enthalten, bestätigen sie letztlich die Gefahr, die von einer professionellen, staatlich unterstützten Hackerszene hervorgeht, ganz gleich, ob diese nun aus China, Russland, Iran oder Nordkorea kommt.

Ende Januar sagte FBI-Direktor Christopher Wray vor einem US-Kongressausschuss, dass chinesische Staatshacker ihre Angriffe auf die US-amerikanische Infrastruktur, darunter Wasser-, Energie- und Verkehrsbetriebe, ausweiten würden. Im Dezember gab es Berichte, wonach chinesische Hackergruppen bereits in vereinzelte Systeme, darunter einen Wasserversorger in Hawaii, eingedrungen seien. Laut Wray sei das chinesische Hackerprogramm mittlerweile "größer als das aller anderen großen Nationen zusammen". Auf einen Hacker des FBI kämen 50 chinesische.

Seitennavigation

STARTSEITE

- Mailen

Pocket

Flippen

Twittern

Facebook

Jetzt teilen auf:

Schlagwörter

- China

,

- Hackerangriff

,

- Spionage

,

- Datenschutz

,

- IT-Sicherheit

,

- Hacker

- ,

Alle Themen

12 Kommentare

Meine KommentareHighlightsNeusteÄlteste

?

b

bowsman

Alle kaufen bei temu. Jeder will billige Produkte. Jeder will billiges Gas . Wurscht was die Chinesen hacken oder angreifen.Wurscht ,was die Russen hacken oder angreifen. Dieses Land geht vor die Hunde? Aber nicht so ,wie sich die meisten Leute das vorstellen,sondern wegen der meisten Leute!

⭐️ 17❤️ 9🙁 2🤨 2😲 2

Antworten schließenAntwort schreiben

l

letreo

Sorry, das ist nicht wahr, ich kaufe den chinesischen Schrott bei Temu nicht! Bei manchen Dingen gibts leider keine oder kaum Alternativen. Entscheidender bzgl. Temu & Co. ist eher, dass man nicht jeden Sch… kaufen muss, nur weil es einem angeboten wird!

In Bezug auf „ist mir doch sch… egal, was Russland, China, … machen, betrifft ja nicht mich“, könnte ich regelmäßig 🤢🤮. Solange viel Menschen keiner direkt eine Knarre an den Kopf hält, sind sie diesbezüglich blind oder komplett empathielos.

⭐️ 1❤️ 1

Antwort schreiben

S

Storax

"Alle kaufen bei temu. Jeder will billige Produkte. Jeder will billiges Gas . " Alle, und Jeder beinhaltet Sie auch, richtig?

Antwort schreiben

Antworten schließen

T

ThatsLife943

Immer fleißig weiter in China investieren und chinesische Waren kaufen. Was soll da schon schief gehen? /s

⭐️ 14❤️ 6😁 2

Antwort schreiben

SM

St.Ma

Wir reden doch immer von "Fluchtursachen bekämpfen", und "Afrika eine Perspektivebieten"

Ich wünschte mir, wir würden in dieser Richtung Partner finden.

Eine Werkbank für deutsche Unternehmen und Absatzmärkte für beispielsweise unsere Maschinen. Ich unterstelle Afrika mal zunächst weniger Heimtücke als China.

Wir haben uns in China extrem abhängig gemacht. Vorprodukte, Medikamente, seltene Erden u.v.m.

Wir werden Afrika noch brauchen, mit Sonnenenergie im Überfluss und Rohstoffen aller Art.

China ist eines der miesesten Länder im Demokratieindex. China unterdrückt Völker und Menschen.

Und spionieren uns weltweit aus.

Ganz bestimmt nicht zu unserem Besten!

Wir sollten uns dringend (auch) andere Geschäftspartner suchen. Wenn die Verbindungen reißen z.b in einem möglichen Taiwankonflikt, können wir einpacken

Auf nach Afrika!

⭐️ 4❤️ 2😲 2

Antworten schließenAntwort schreiben

l

letreo

Wer soll die Maschinen bezahlen? Wie viel Geld hätten Afrikaner in ihren Ländern investieren können, die in Deutschland studiert haben, in Afrika aber flux nichts zur Verbesserung der Situation der Gesamtbevölkerung, sondern zur eigenen Bereicherung genutzt? Investitionen werden regelmäßig durch korrupte Regierungen und Bürgerkriege vernichtet.

⭐️ 1❤️ 1

Antwort schreiben

t

tomoko

ohhh ja afrika, ein traum wuerde war fuer mich...nur investieren in afrika ?unruhen, korruption gewalt an jeder ecke. sued afrika und nelson mandela waren ein traum der leider auch gescheitert ist. afrika muss in die poette kommen wie man so sagt. um das zu erreichen bedarf es einer gewaltigen anstrengung in afrika. es muesste das unrecht der kolonialzeit bezueglich der grenzziehung bereinigt werden..sprich alle staemme und voelker setzen sich zusammen und beschliessen gerechte und korrekte grenzen...ohne einfluss von ausserhalb....erst dann...wenn das geschaft wuerde haette afrika eine chance auf friedliche entwicklung, die jetzigen laendern mit all ihren ethnichen gruppen werden doch brutal von amerikanern, europaeern und chinesen gegeneinander ausgespielt. es ist eine mamut aufgabe aber schlimmer als es jetzt ist kann es fuer viele gebiete in afrika nicht mehr werden

Antwort schreiben

Antworten schließen

F

FalkAlexander

Gut, dass wir das im vorbildlichen Westen nicht machen. Wer was anderes behauptet, gehört eingesperrt.

⭐️ 2😁 3🙁 2🤨 4😲 2

Antwort schreiben

WK

W.- K.

Die Chinesen brauchen keine "ausgefeilten" Methoden.

Die Politiker verstehen ja noch nicht mal etwas von den Grundlagen der Computerei, die Glauben glatt, Sicherheitslücken könne man Exclusiv haben und halten.

Praktizierte Dummheit und Ignoranz auf höchsten Niveau herrschen vor.

⭐️ 3❤️ 1🙁 1

Antwort schreiben

t

tomoko

das chinesiche fa. daten an die partei abfuehren ist seit langem eine gewissheit und zwar nicht erst als ein gesetz firmen in china dazu verpflichtete. viele chinesiche firmen zocken ihre auslaendische kundschaft zum wohle von partei und staat ab. jeder der sich ein bischen mit china beschaeftigt ist sich darueber bewusst, nur scheint diese tatsache noch nicht in den koepfen von firmen chefs angekommen zu sein.. in einem seiner gedanken hat xi das volk aufgefordert mit allen mitteln die fuehrerschaft in technologie zu erringen, datenklau incl. china verspricht den westlichen firmen viel gewinn und gewinn/profit ist die droge und china der pusher/haendler dieses gewinns....wenn der dumme westler dann in abhaengig ist wird der pusher sein richtiges gesicht zeigen....kann man schon in anderen laendern beobachten.

⭐️ 4

Antwort schreiben

C

Camper17

„Auf einen Hacker des FBI kämen 50 chinesische.“

Eine Ursache für den Niedergang der DDR war auch, dass am Ende immer mehr der volkswirtschaftlichen Leistung in Kontrolle (Stasi etc.) floss.

Freiheit ist der Garant für Wohlstand.

⭐️ 3

Antwort schreiben

Avatarbild von Darth Nihilus

Darth Nihilus

Lügen streuen 6x mehr als evidente Fakten (“The Social Dilemma“). Menschen teilen negative Informationen 10x öfter als positive und sind viel tiefer in ihnen investiert (“The Man Who Lied to His Laptop: What Machines Teach Us About Human Relationships”). Das ist durch unseren Schutzinstinkt motiviert.

Die Reichweite jeder Nachricht lässt sich durch diese Mechanismen leicht vervielfachen.

Bewusst oder unbewusst beeinflusst das den Kontext und die Qualität der Inhalte.

Kritik reist weiter, wird intensiver vertieft als Lob, positive Beobachtungen. Je negativer und intensiver, desto grösser.

Somit entstehen Gesamtstimmungen und sie werden auch explizit erzeugt, die wiederum die Meinungsbildung beeinflussen. Meinungsbildung kann durch einen Mangel an Medienkompetenz leicht korrumpiert werden. Und wer einen Mangel an Medienkompetenz aufweist, ist auch leichter korrumpierbar.

Und das Wissen, wer sich diese Möglichkeiten der Meinungsbeeinflussung zunutze machen könnte und wie, sollte neben Recherche, Analyse, Kontextualisierung, Plausibilitätsprüfung und Interpretation auch Bestandteil der Medienkompetenz sein.

Wir müssen uns bewusst(er) machen, dass die oben beschriebene Dynamik von obszön gigantischen Summen an Geld, Armeen bestausgebildeter Psychologen und Marketingexperten befeuert wird. Dort wird um jede Minute unserer Lebenszeit gekämpft.

In Software/Online und Drogenmilieu heisst der Adressat übrigens exakt gleich: User.

Die 5. Gewalt codiert die Synapsen gesellschaftlichen Dialogs.

Spies for Hire: China’s New Breed of Hackers Blends Espionage and Entrepreneurship

The state security ministry is recruiting from a vast pool of private-sector hackers who often have their own agendas and sometimes use their access for commercial cybercrime, experts say.

- Share full article

- 64

China has changed its tactics since cyberhacking responsibilities were transfered to the Ministry of State Security from the People’s Liberation Army.

Credit...

Alex Plavevski/EPA, via Shutterstock

Paul Mozur

Chris Buckley

By Paul Mozur and Chris Buckley

Aug. 26, 2021

阅读简体中文版閱讀繁體中文版

China’s buzzy high-tech companies don’t usually recruit Cambodian speakers, so the job ads for three well-paid positions with those language skills stood out. The ad, seeking writers of research reports, was placed by an internet security start-up in China’s tropical island-province of Hainan.

That start-up was more than it seemed, according to American law enforcement. Hainan Xiandun Technology was part of a web of front companies controlled by China’s secretive state security ministry, according to a federal indictment from May. They hacked computers from the United States to Cambodia to Saudi Arabia, seeking sensitive government data as well as less-obvious spy stuff, like details of a New Jersey company’s fire-suppression system, according to prosecutors.

The accusations appear to reflect an increasingly aggressive campaign by Chinese government hackers and a pronounced shift in their tactics: China’s premier spy agency is increasingly reaching beyond its own ranks to recruit from a vast pool of private-sector talent.

This new group of hackers has made China’s state cyberspying machine stronger, more sophisticated and — for its growing array of government and private-sector targets — more dangerously unpredictable. Sponsored but not necessarily micromanaged by Beijing, this new breed of hacker attacks government targets and private companies alike, mixing traditional espionage with outright fraud and other crimes for profit.

China’s new approach borrows from the tactics of Russia and Iran, which have tormented public and commercial targets for years. Chinese hackers with links to state security demanded ransom in return for not releasing a company’s computer source code, according to an indictment released by the U.S. Department of Justice last year. Another group of hackers in southwest China mixed cyber raids on Hong Kong democracy activists with fraud on gaming websites, another indictment asserted. One member of the group boasted about having official protection, provided that they avoid targets in China.

“The upside is they can cover more targets, spur competition. The downside is the level of control,” said Robert Potter, the head of Internet 2.0, an Australian cybersecurity firm. “I’ve seen them do some really boneheaded things, like try and steal $70,000 during an espionage op.”

Investigators believe these groups have been responsible for some big recent data breaches, including hacks targeting the personal details of 500 million guests at the Marriott hotel chain, information on roughly 20 million U.S. government employees and, this year, a Microsoft email system used by many of the world’s largest companies and governments.

The Microsoft breach was unlike China’s previously disciplined strategy, said Dmitri Alperovitch, the chairman of Silverado Policy Accelerator, a nonprofit geopolitical think tank.

“They went after organizations they had zero interest in and exploited those organizations with ransomware and other attacks,” Mr. Alperovitch said.

China’s tactics changed after Xi Jinping, the country’s top leader, transferred more cyberhacking responsibility to the Ministry of State Security from the People’s Liberation Army following a slew of sloppy attacks and a reorganization of the military. The ministry, a mix of spy agency and Communist Party inquisitor, has used more sophisticated hacking tools, like security flaws known as zero days, to target companies, activists and governments.

Image

President Xi Jinping was embarrassed by revelations of the People’s Liberation Army’s hacking activities and gave more responsibility to the Ministry of State Security.

Credit...

Ng Han Guan/Associated Press

While the ministry projects an image of remorseless loyalty to the Communist Party in Beijing, its hacking operations can act like local franchises. Groups often act on their own agendas, sometimes including sidelines in commercial cybercrime, experts said.

The message: “We’re paying you to do work from 9 to 5 for the national security of China,” Mr. Alperovitch said. “What you do with the rest of your time, and with the tools and access you have, is really your business.”

A grand jury indictment released last year charged that two former classmates from an electrical engineering college in Chengdu, in southwest China, marauded through foreign computer servers and stole information from dissidents and engineering diagrams from an Australian defense contractor. On the side, the indictment said, the two tried extortion: demanding payment in return for not revealing an unidentified company’s source code on the internet.

Under this system, Chinese hackers have become increasingly aggressive. The rate of global attacks linked to the Chinese government has nearly tripled since last year compared with the four previous years, according to Recorded Future, a Somerville, Mass., company that studies the use of internet by state-linked actors. That number now averages more than 1,000 per three-month period, it said.

“Considering the volume that’s going on, how many times has the F.B.I. gotten them? Precious few,” said Nicholas Eftimiades, a retired senior American intelligence officer who writes about China’s espionage operations. “There’s no way you can staff up to be able to contend with this type of onslaught.”

Though their numbers make them hard to stop, the hackers don’t always try hard to cover their tracks. They sometimes leave clues strewn online, including wedding photos of agents in state security uniforms, telltale job ads and boasts of their feats.

Hainan Xiandun was set up to recruit young talent and create a veneer of deniability, prosectors said. It posted job ads on the message boards of Chinese universities and sponsored a cybersecurity competition.

The operations from Hainan — an island jutting into the South China Sea — sometimes reflected local priorities, like stealing marine research from a university in California and hacking governments in nearby Southeast Asian countries, according to the May indictment. Its job ad for Cambodian speakers was placed three months before Cambodian elections.

While some targets had clear espionage goals, others appeared less focused. The hackers tried to steal Ebola vaccine data from one institution, prosecutors said, and secrets about self-driving cars from another.

Image

The Department of Justice unsealed an indictment in July detailing the exploits of a Chinese hacking group.

Credit...

Stefani Reynolds for The New York Times

In January 2020, a mysterious blog with a track record of exposing Chinese state security hackers picked up the scent. The blog, “Intrusion Truth,” was already known in Washington cybersecurity circles for naming Chinese intelligence officers well before they appeared in U.S. indictments.

The operators of “Intrusion Truth” scoured job boards for Hainan companies advertising for “penetration testing engineers,” who secure networks by exploring how they could be hacked.

One posting from Hainan Xiandun stood out. The ad, on a Sichuan University computer science hiring board from 2018, boasted that Xiandun had “received a considerable number of government-secret-related business.”

The company, based in Hainan’s capital, Haikou, paid monthly salaries of $1,200 to $3,000 — solid middle-class wages for Chinese tech workers fresh out of college — with bonuses as high as $15,000. Xiandun’s ads listed an email address used by other firms looking for cybersecurity experts and linguists, suggesting they were part of a network.

Chinese hacking groups are increasingly “sharing malware, exploits and coordinating their efforts,” the operators of “Intrusion Truth” wrote in an email. The operators have not disclosed their identities, citing the sensitivity of their work.

Xiandun’s registered address was the library of Hainan University. Its phone number matched that of a computer science professor and People’s Liberation Army veteran who ran a website offering payments for students with novel ideas about cracking passwords. The professor has not been charged.

Other records and phone numbers led the blog authors to an email address and a frequent-flier account owned by Ding Xiaoyang, one of the managers of the company.

The indictment asserted that Mr. Ding was a state security officer who ran the hackers working at Hainan Xiandun. It included details the blog did not find, like an award Mr. Ding received from the Ministry of State Security for young leaders in the organization.

Mr. Ding and others named in the indictment couldn’t be reached.

Though trackable for now, China’s state security apparatus may be learning how to better hide its footprints, said Matthew Brazil, a former China specialist for the Department of Commerce’s Office of Export Enforcement who has co-written a study of Chinese espionage.

“The abilities of the Chinese services are uneven,” he said. “Their game is getting better, and in five or 10 years it’s going to be a different story.”

Nicole Perlroth contributed reporting.

Paul Mozur is a correspondent focused on technology and geopolitics in Asia. He was part of a team that won the 2021 Pulitzer Prize in public service for coverage of the coronavirus pandemic. More about Paul Mozur

Chris Buckley is chief China correspondent and has lived in China for most of the past 30 years after growing up in Sydney, Australia. Before joining The Times in 2012, he was a correspondent in Beijing for Reuters. More about Chris Buckley

A version of this article appears in print on Aug. 27, 2021, Section B, Page 1 of the New York edition with the headline: China Hires New Breed Of Hackers. Order Reprints | Today’s Paper | Subscribe

Comments 64

SKIP TO COMMENTS

The comments section is closed. To submit a letter to the editor for publication, write to letters@nytimes.com.

- Reader Picks

- All

Sort by: Newest

TheBackman commented August 27, 2021

T

TheBackman

Berlin, GermanyAug. 27, 2021

Thank goodness America doesn't do anything like this. Snowden made it very clear, only shiny happy people. I think all these people are making a major case for how much we do not need government

2 Recommend

Flag

1 REPLY

HG commented August 27, 2021

H

HG

Princeton, NJAug. 27, 2021

In my view, the failures and bad tendencies of governments do not mean that we do not need government. We need good government.

4 Recommend

Flag

C in Atlanta commented August 27, 2021

C

C in Atlanta

Greater AtlantaAug. 27, 2021

The Chinese and, I assume, the Russians have effectively revived privateering, except that the new breed aren't plying the high seas, like, say, Sir Francis Drake, but surfing the internet, instead -- with enough plausible deniability to prevent war most of the time.

3 Recommend

Flag

Usok commented August 27, 2021

U

Usok

HoustonAug. 27, 2021

John Kerry will visit China soon to talk about climate change. I am sure he will talk about cyber security if the issue is critical enough. But I doubt it. US needs to resolve many critical issues with China before any physical meeting between Biden and Xi could occur during G-20 meeting in Rome. Otherwise, Xi will stay in Beijing using video-conferencing to participate the G-20 meeting. As long as we continue to use internet, cyber security will always be a concern of non-issue.

Recommend

Flag

jim commented August 26, 2021

J

jim

bostonAug. 26, 2021

I still do not understand why state sponsored cyberattacks are not construed as an act of war

8 Recommend

Flag

Alexander commented August 26, 2021

A

Alexander

Charlotte, NCAug. 26, 2021

Hold China accountable for their lackeys and retaliate with tariffs that make the Trump ones seem like Monopoly money. If it starts a trade war, good; anything we can possibly do to disentangle our economy from China is helpful.

10 Recommend

Flag

David H. commented August 26, 2021

D

David H.

Miami Beach, FLAug. 26, 2021

Me thinks the US should encourage and recruit inner-city and rural youth similarly - compared to thousands of hours in athletics or participation in gang/drug-related activity - in order to encourage re-thinking by these other countries, as well as to increase American participation in tech.

2 Recommend

Flag

JD commented August 26, 2021

J

JD

DallasAug. 26, 2021

US hacked Huawei, showed China that you have to be a cyber superpower to guard national interest. https://www.nytimes.com/2014/03/23/world/asia/nsa-breached-chinese-servers-seen-as-spy-peril.html The Wuhan Institute of Virology was also hacked. https://www.cnn.com/2021/08/05/politics/covid-origins-genetic-data-wuhan-lab/index.html This is the new norm now.

9 Recommend

Flag

Mostly commented August 26, 2021

M

Mostly

Henderson, NVAug. 26, 2021

Just use dumb equipment with no connectivity. The economy ran fine with them for centuries.

4 Recommend

Flag

Lyle Davis commented August 26, 2021

L

Lyle Davis

Tri-stateAug. 26, 2021

Trump can ask China to look for Hillary's emails.

3 Recommend

Flag

1 REPLY

David H. commented August 26, 2021

D

David H.

Miami Beach, FLAug. 26, 2021

@Lyle Davis Or Biden can bring this up when Vlad calls in another "favor," such as maybe another oil pipeline, for example. One can only imagine how much Russia has on the White House's Picasso.

1 Recommend

Flag

Joe commented August 26, 2021

J

Joe

CaliforniaAug. 26, 2021

China is engaging in cyber warfare, testing the limits of American patience. We need to enact the equivalent of the mutually assured destruction (MAD) policy of the nuclear Cold War era to get them to stop. We also need to explore having 2 internets, one of which would be closed (air gapped) to the rest of the world.

3 Recommend

Flag

Aaron commented August 26, 2021

A

Aaron

San FranciscoAug. 26, 2021

It’s a good thing the United States doesn’t have any private companies that hack our citizen’s data and then sell it to governments for profit. We had better keep an eye on this.

3 Recommend

Flag

1 REPLY

W commented August 26, 2021

W

W

Minneapolis, MNAug. 26, 2021

@Aaron Your comment reminded me that the N.S.A. does not actually engage in hacking activities. They are oversight. If they want something done they hire a private defense contractor to do it. For example, Edward Snowden did not work for the N.S.A. He worked for Booz Allen Hamilton.

Recommend

Flag

Stephen Merritt commented August 26, 2021

S

Stephen Merritt

Gainesville, FloridaAug. 26, 2021

Well, now, this certainly seems to have overtones of the KGB's cooperation with Soviet-era organized crime...

Recommend

Flag

Johnny G commented August 26, 2021

J

Johnny G

IndianaAug. 26, 2021

One of these day's, our politician's, and CEO's will snap out of the illusion they have been in, and remember, oh yeah, China is a communist country and be their not our friend. Unfortunately, by then, American industry has greatly contributed to China's economic success, and broke America's back.

10 Recommend

Flag

1 REPLY

Acme Joe commented August 26, 2021

A

Acme Joe

ConnecticutAug. 26, 2021

Just to be clear…a country does not have to be “communist” to be “not our friend”. Nations have had intense rivalries since “nations” were invented…and it usually revolves around what might be called commercial interests…with religion also being a factor at times.

1 Recommend

Flag

Chris PD commented August 26, 2021

C

Chris PD

TorontoAug. 26, 2021

Why is the west not doing this? We have people who could do this.

3 Recommend

Flag

W commented August 26, 2021

W

W

Minneapolis, MNAug. 26, 2021

In this article the Chinese are demonstrating their utter lack of understanding of intellectual property rights, specifically with respect to the various export laws around the world. In China, like in the United States, deliverables from Government financed R&D projects...like the development of software...are subject to export restrictions. Unless the software is used in a munition or for police use, these export restrictions are based solely on the various anti-dumping laws. It's the same problem that's plagued Boeing and Airbus for years: Government subsidies for R&D projects make their products subject to the anti-dumping laws. According to the article: "The ad, on a Sichuan University computer science hiring board from 2018, boasted that Xiandun had 'received a considerable number of government-secret-related business.'" If computer MALWARE is developed with Government financing, any software that contains it can be impounded at the border of the United States on the basis of intellectual property theft (copyright piracy). Another glaring problem is the removal of copyright clauses on software. A ransomware attack "demanding payment in return for not revealing an unidentified company’s source code on the internet" also means that code is not subject to copyright infringement, because only the author can sue. Perhaps these problems are because the Chinese Communist Party doesn't care diddly-squat about private ownership of intellectual property rights.

3 Recommend

Flag

Bruce F commented August 26, 2021

B

Bruce F

MontanaAug. 26, 2021

Far too many governments, including those of Russia, China, Iran, Brazil, and the United States, have irresponsibly stoked jingoistic nationalism and encouraged zero-sum thinking. In this world-view, it is "my country first," and whatever hurts a perceived rival nation must be good for my own homeland. It is an easy ploy for opportunistic politicians and authoritarians, to deflect attention from their own failings. It is also an appalling waste of human potential that could be better employed in cooperative endeavors. Not a good augury for a planet with nearly eight billion people and finite resources.

5 Recommend

Flag

Tom commented August 26, 2021

T

Tom

San DiegoAug. 26, 2021

Such a shame. A great people, great country, reduced to fighting ghosts. It will be the undoing of the current government.

2 Recommend

Flag

rich williams commented August 26, 2021

R

rich williams

long island nyAug. 26, 2021

The world's opinion of China is incredibly low because of behavior like this. The average Westerner thinks of Chinese people as hardened and ruthless criminals. They appear incredibly insecure and struggling to overcome a severe inferiority complex. Their society is amazingly immature compared to Europe and the USA. Every day their "stock" goes down. The embarrassment center of their brains appears to have been surgically removed or never developed.

8 Recommend

Flag

2 REPLIES

KA commented August 26, 2021

K

KA

HarrisonburgAug. 26, 2021

WOW! Brushing 1.7 billion people with a single brush. This is sad

3 Recommend

Flag

Charles commented August 26, 2021

C

Charles

New YorkAug. 26, 2021

@KA You are correct. Those 1.7 billion people have less say in the actions of their government than do the international corporations (yes, American as well) who enable these actions all in the name of shareholder profit. Couple that with an American consumer who doesn't give a hoot other than to continue their addiction to cheap imports while ignoring the hidden costs of those "too good to be true" prices.

2 Recommend

Flag

Yoda commented August 26, 2021

Y

Yoda

Somewhere In GalaxyAug. 26, 2021

why no information on where we can hire such people in the article?

Recommend

Flag

Ground Zero. commented August 26, 2021

Ground Zero.

Ground Zero.

34North 70 EastAug. 26, 2021

It seems the Chinese Communist party has learned capitalism very well indeed. Isn’t this the model for American companies? From Government to Corporate entities, Hire contractors to avoid paying benefits and shirking responsibilities for civil society. Let’s understand that the 3rd world war has begun. But why Blow up stuff when one can control and benefit from the enemies’ commodities free? China hasn’t ascended, she has awakened. Thanks to the world wanting cheaper stuff.

3 Recommend

Flag

Judy commented August 26, 2021

J

Judy

NYAug. 26, 2021

Exactly why is vulnerable valuable information on the internet?

Recommend

Flag

1 REPLY

Carl Vincent commented August 26, 2021

C

Carl Vincent

Rensselaer NYAug. 26, 2021

@Judy It is stolen from hardworking individuals and hardworking American companies by nation state bad actors .... as this article illustrates. These folks get up in the morning pour a cup of coffee or tea, fire up their laptop and go to work. It is how they feed their families. Once stolen its ransomed for purchase back. The latest trick is to post the info to the dark web to the highest bidder... even if you paid the ransom. Sick world we live in.

1 Recommend

Flag

Greg commented August 26, 2021

G

Greg

WashingtonAug. 26, 2021

I could have written the core of this article 10 years ago! Nothing has really new except the MSS is providing zero-day information for their leagues of independent hackers where in the past, it was mostly the reverse. The Chinese hackers are constantly scanning for vulnerabilities choosing any target of opportunity thus they have a broad-base of targets to choose from due to poor security on our part. Ultimately our government must intercept hacking activity BEFORE it gets to targets just like China does with their "Great Firewall of China". So far our government has kept itself at arms length because of civil liberties concerns.

6 Recommend

Flag

ABC commented August 26, 2021

A

ABC

FlushingAug. 26, 2021

USA’s openness makes spying easy. “The Foreigner Question” in China is a nonissue and always has been. “There have been millions and millions of Chinese Americans but zero American Chinese “ says Harvard’s Eric Liu, a Chinese American. NonChinese are blocked in every way imaginable. For Chinese, racism is patriotism. That’s the Great Wall. Chinese have entry into every US avenue, corporation, university, military installation. Recently, Chinese demanded (not asked) unconditional surrender at SCOTUS in that that all seats at Harvard be forfeited to Chinese with good test scores. Has any American ever had a day in any court in China? Never. I lived in China Korea Japan 18 years. Spying on US from within USA is easy. Americans are too naive

25 Recommend

Flag

3 REPLIES

Chris PD commented August 26, 2021

C

Chris PD

TorontoAug. 26, 2021

@ABC this is why we should yank every Chinese student visa in the Western world

1 Recommend

Flag

Frank commented August 26, 2021

F

Frank

MexicoAug. 26, 2021

@Chris PD I agree 100% Chinese students should not be allowed to study in the west. Let's see how far China advances with its own education system.

1 Recommend

Flag

Roberta commented August 27, 2021

R

Roberta

CanadaAug. 27, 2021

@ABC On the contrary. Having Chinese students study in America and Europe helps create a worldly Chinese perspective that acts as a counterweight to narrow nationalist and dictatorial leaders in China. What is needed in America is a diplomatic approach to China that is critical of all nationalist ego trips: American, European Russian and all others. Nationalism is the tool of bullies and tyrants. American workers have a lot in common with Chinese workers and both are turned into serfs as their productivity is siphoned off by the global 1 percent. What we need to ensure is that middle class Chinese get to study in America and not just the children of the rich who already have a contempt for those who labour. Bring in Chinese students who want to study politics, social cooperation, international development and not just computing science.

1 Recommend

Flag

Nancy commented August 26, 2021

N

Nancy

Great NeckAug. 26, 2021

Another day, another Cold War promoting article. This need to vilify China is distressing and never supported and warranted.

8 Recommend

Flag

1 REPLY

Archon commented August 26, 2021

A

Archon

LAAug. 26, 2021

@Nancy Let me help you with this - This need to vilify China is distressing and never supported and warranted but vilifying the US is encouraged!

4 Recommend

Flag

ABC commented August 26, 2021

A

ABC

FlushingAug. 26, 2021

Chinese use Americans’ openness to subvert naive Americans from within US corporations and institutions. It works. Japan enrolled Yamamoto at Harvard and even the US Naval Academy. He became Admiral Yamamoto. Japanese gave 3000 cherry trees to ironically place around US National Monuments. The gift accepted, Japan then started its US spy network culminating in the Pearl Harbor Attack and John Semer Farnsworth, who attempted to hand the US Navy code book to Japan. Chinese will soon use Western names to flood these comments and spread disinformation. I lived in China Korea Japan 18 years. Learn Chinese. You’re going to need it. Americans are childlike. No match for Chinese

17 Recommend

Flag

1 REPLY

Pierre commented August 26, 2021

P

Pierre

WorldAug. 26, 2021

@ABC What about NSO Pegasus software: sold to every dictatorship on the block and used to spy on democratic leaders. What about the NSA, CIA and all covert operations? Iran centrifuge? Naive Americans might be. But not necessarily in the direction implied by this comment.

1 Recommend

Flag

Jerry Harris commented August 26, 2021

J

Jerry Harris

ChicagoAug. 26, 2021

Now where is your story on the vast cyber spying carried out by the US government?

7 Recommend

Flag

1 REPLY

Reformist commented August 26, 2021

R

Reformist

RenoAug. 26, 2021

@Jerry Harris Sure, it's all part of the spy vs. spy game, but obviously the U.S. operates with one hand tied behind its back (or is it both?) We probably lose more than we win. Haven't seen any ransomware attacks by us on Chinese companies lately.

5 Recommend

Flag

Bruce1253 commented August 26, 2021

B

Bruce1253

San DiegoAug. 26, 2021

Why are we still doing business with China? They mean us harm, our trade dollars go towards Chinese enterprises that hurt our businesses and government. Things like hacking, financing 'Student Spies', their military, stirring up trouble around the world. COVID originated in China and has ravaged the world. It matters not if you think it started in a lab or in a wet market, primitive Chinese sanitation and public health practices and an incompetent government allowed to it spread to the world. The Chinese are not fit to be world leaders, their policies enslave their own people, large sections of their land are waste lands due to no environmental laws and corruption not enforcing the few they do have. They are anti-free trade. I will ask again, why are we still doing business with China?

42 Recommend

Flag

4 REPLIES

Jon commented August 26, 2021

Jon

Jon

Washington, DCAug. 26, 2021

As distasteful as our relations have grown, the main advantage of continuing trade relations is to stave off the potential for direct armed conflict. Severing trade relations would immediately plunge us into a Cold War which could easily turn hot.

3 Recommend

Flag

Bruce1253 commented August 26, 2021

B

Bruce1253

San DiegoAug. 26, 2021

@Jon I am sorry to have to say this, but you are naive if you think China or any nation will not follow through on something in their national interest because of trade. China recognizes that they are already in the beginning stages of a war with the US. We do not, I am recommending we stop being naive, we must stop enriching our enemy.

7 Recommend

Flag

Reformist commented August 26, 2021

R

Reformist

RenoAug. 26, 2021

@Jon Tough as it is to do, this unfortunately rings quite true. Sometimes you have to hold your nose, as in all politics, domestic and foreign.

1 Recommend

Flag

justgimmesometruth commented August 26, 2021

J

justgimmesometruth

New YorkAug. 26, 2021

@Bruce1253: The Chinese people are NOT enslaved as you suggest. The average Chinese citizen would find the idea laughable. Most Chinese are firmly behind Xi's policies. They are very happy with the economic progress that their country has continued to make, and in which they are share. They are support Xi's push for strong defenses against the US. Everyone knows that the US is capable of flattening a nation with shock and awe as they did in Iraq, based on non-existent WMDs. Every Chinese citizen knows that the US could do the same to them if China does not have strong defenses. And the idea that "large sections of their land are waste lands due to no environmental laws" is utter nonsense. China is a country of small farms that use good farming practices, vs. the US which is a country of large agribusiness. And anti-free trade? The US is anti-free trade. US policy is all about tariffs. And you think China's government is "incompetent"? That is certainly not true. When covid is not such a danger, I suggest that you visit China to see for yourself. There's plenty wrong with China, of course, but your view of China is highly inaccurate.

1 Recommend

Flag

justgimmesometruth commented August 26, 2021

J

justgimmesometruth

New YorkAug. 26, 2021

Stop! The problem here is not Chinese hackers, or Russian hackers, or Israeli hackers. You cannot eliminate the presence of hackers anymore than you can eliminate the presence of burglars. The problem is that the US refuses to put up ANY sort of cyber defense. We leave our doors and windows WIDE open, and then complain that other countries are bad actors when we are hacked. We have not yet begun to see the folly of this national policy. I'm not even talking about sophisticated hacking. Let's start with the fact that our landline telephony system was once secure. Circuit-based technology meant that the location of a caller and the owner of the phone could be identified. This level of security is gone. I often receive a half dozen calls a day from local phone numbers that are social security or car warranty scams, possibly coming from other countries. Our mobile phone network is even more compromised, and email is completely insecure. The Internet is now at the core of our national communications infrastructure, but there is zero control over users. Once there was talk of an Internet II where REAL registration would be required. It never happened. Our government barely protects its own communication infrastructure and it does NOTHING to protect non-governmental networks. Until the US gets serious about cyber defense, we will continue to wring our hands and complain about bad actors every time we are hacked.

41 Recommend

Flag

1 REPLY

Les commented August 26, 2021

L

Les

BethesdaAug. 26, 2021

@justgimmesometruth Spot on! The internet was never constructed for what it is being used for. It is a gigantic kludge - about as vulnerable as a system could possibly be.

1 Recommend

Flag

Lilly commented August 26, 2021

L

Lilly

New HampshireAug. 26, 2021

As a private citizen who has lived in Asia, and has Chinese relatives through marriage, I know how dangerous China is to the rest of the world because of the unified Chinese intension to subjugate the rest of the world. I hope we do everything possible to keep them from their goal.

37 Recommend

Flag

Phil E. commented August 26, 2021

P

Phil E.

BrooklynAug. 26, 2021

How quickly people forget Snowden, PRISM, the hacking of the German Chancellor's phone, Assange, the NSA, etc...Also have we forgotten when our Credit Rating agencies experienced huge data thefts years ago, when Chinese hackers were just a blip on the horizon? The way I see it, China is merely upgrading its Cyberwarfare capabilities, to be on the same level as us, Russia, Israel, etc...This is a good and interesting article but the facts in it should not really come as a suprise in today's geo-political environment.

39 Recommend

Flag

1 REPLY

ABC commented August 26, 2021

A

ABC

FlushingAug. 26, 2021

@Phil E. China thanks you. With millions of America-hating Americans like you, our goals get nearer daily. We are hiring. You seem ideal

7 Recommend

Flag

PC commented August 26, 2021

P

PC

Aurora, COAug. 26, 2021

“China’s premier spy agency is increasingly reaching beyond its own ranks to recruit from a vast pool of private-sector talent.” Is ‘open source’ hacking cheaper and more effective for government? Unfortunately this appears so. If true, I encourage the US to offer bounties for private citizens to hack Chinese and Russian assets. This should give pause to countries seeking to destabilize through cyber capabilities. Or again…maybe not.

18 Recommend

Flag

John Malister commented August 26, 2021

J

John Malister

New YorkAug. 26, 2021

Among the US hacker community it's well known that nearly everyone has worked for the US government in some capacity at one time or another. Typically the FBI or NSA will scoop these hackers up — often when they're just kids messing around online — on some trumped up cybercrime charges and offer to let them off the hook if they turn informant or do work for the government. They show up at every hacker conference including DEF CON. They also do a lot of recruitment from Computer Science graduate schools, particularly in fields like cryptography. A *LOT* of the cybersecurity folks who work for the NSA, FBI and CIA have clandestine roles and maintain normal day jobs. Which is all to say that China isn't doing anything the US government hasn't been doing for decades. The more interesting question is why is the New York Times trying to instill fear of China in the American public? Why cover an issue like cybersecurity in such a lopsided way, neglecting to contextualize China's hacking alongside America's?

52 Recommend

Flag

6 REPLIES

Alex commented August 26, 2021

A

Alex

TxAug. 26, 2021

No john the US has not been hacking just like China. Industrial espionage and ransoming private companies and government agencies is what China is ramping up on, this is not what the US does by enlarge. That’s the point of the article. Stop with the false equivalency.

40 Recommend

Flag

MJW commented August 26, 2021

M

MJW

DCAug. 26, 2021

@John Malister I would hope that they're not committing crimes currently under the ageis of the federal government, and if you have evidence of crimes, you need to come forward and not post dumb provocative accusations.

20 Recommend

Flag

Chris PD commented August 26, 2021

C

Chris PD

TorontoAug. 26, 2021

@Alex well they should have been. LFG

Recommend

Flag

Judgeboyajian10 commented August 26, 2021

Judgeboyajian10

Judgeboyajian10

FishkillAug. 26, 2021

This is moving China closer to confrontation with the United States and most of the world.

12 Recommend

Flag

Kirill commented August 26, 2021

K

Kirill

DCAug. 26, 2021

Such a great reporting. Please more stories on CCP sponsored entities.

27 Recommend

Flag

John commented August 26, 2021

J

John

92024Aug. 26, 2021

As much as China funds infrastructure and can build new hospitals in ten days, I suspect they spend even more on cyber "security" with all their camera tracking, people monitoring, etc. I fear that the US is way too far behind intellectually and financially, to compete with their resources and the responsible players, the CIA, etc., are obviously buffoons who don't even know that Afghanistan can be a walk-in takeover in ten days. It seems that Australia cares and knows what's coming, but they don't fund thousands of cyber "warriors" the way China does both in social media manipulation and just plain criminal spying and systems incursions world-wide. The US isn’t even on the playing field.

10 Recommend

Flag

1 REPLY

Reformist commented August 26, 2021

R

Reformist

RenoAug. 26, 2021

@John Let's hope against hope the US agencies are doing more and better than we hear about.

Recommend

Flag

Usok commented August 26, 2021

U

Usok

HoustonAug. 26, 2021

According to this report, China can do better with more sophistication and complexity. Of course, using an ad to come up with this theory is a bit shaky. We need more facts on the ground to substantiate this story. Let's be frank, Russia, Israel, and US are the biggest internet powerhouse in the world. Compare to us, China is a minor league player. And we don't need to spend more money on cyber defense.

15 Recommend

Flag

2 REPLIES

MJW commented August 26, 2021

M

MJW

DCAug. 26, 2021

@Usok Our systems are still hacked all the time. We need to spend time and money to get better systems. While the NYT is all confused and distracted with nonsense like a 20 year old war that they never cared about finally ending, climate change and cybercrime are restructuring our entire economy. That's the real challenge of our time: both are fueling the rise of fascism. Hospitals and schools still shut down every day due to ransomware. The feds were recently hacked in major ways. We have to respond forcefully for democratic civilization to persevere. It's too easy to let all the lazy rich in this nation lull us into a false sense of security, because they don't care about tomorrow. We can't let that happen, the fragility of our civilization is real.

11 Recommend

Flag

Reformist commented August 26, 2021

R

Reformist

RenoAug. 26, 2021

@Usok It's notable how well China disguises its propaganda plants like this one

5 Recommend