Budapest Post

Cum Deo pro Patria et Libertate
Budapest, Europe and world news

Chinese cyber spies 'posed as Iranians while targeting Israeli government'

Chinese cyber spies 'posed as Iranians while targeting Israeli government'

According to threat intelligence researchers, the hackers attempts to conceal their origin was more likely an effort to slow down response efforts than actually frame Iran.

A cyber espionage group from China masqueraded as Iranian hackers while breaking into and spying on Israeli government institutions, according to a new report by security researchers.

The report from security company FireEye, which unmasked the group alongside Israeli defence agencies, says there is insufficient evidence to link the espionage group to the Chinese state.

However, the company's threat analysts are confident that the espionage group is Chinese and that its targets "are of great interest to Beijing's financial, diplomatic, and strategic objectives".

The hackers' attempt to conceal their nationality was "a little bit unusual", according to Jens Monrad, who heads the work of FireEye's threat intelligence division Mandiant in EMEA.

"We have seen historically a few false flag attempts. We saw one during the Olympics in South Korea," he told Sky News, referencing Russian hackers pretending to be Chinese and North Korean.

"There might be several reasons why a threat actor wants to do a false flag - obviously it makes the analysis a bit more complex," Mr Monrad told Sky News.

The report focused on cyber spying targeting Israeli government institutions, IT providers, and telecommunications entities, but the group had additionally attempted to hack computer networks in the UAE and elsewhere.

Mr Monrad said the attempt to conceal the hackers' identity "wasn't very clever" but did slow the company's analysis of these incidents, which he added may have been the goal.

The Chinese group attempted to use Farsi in the parts of code which could be recovered by incident response teams, and also used hacking tools associated with Iranian groups that had previously been leaked online.

However, linguistic analysts at FireEye said the terms chosen by the group wouldn't have been used by native Farsi speakers.

"The use of Farsi strings, filepaths containing /Iran/, and web shells publicly associated with Iranian APT [Advanced Persistent Threat] groups may have been intended to mislead analysts and suggest an attribution to Iran," the report said.

FireEye said that although this group and the known state-sponsored group designated APT 27 had some overlaps, particularly in their targets, the company could only have low confidence in linking them together.

The Iranian government accused APT 27 of hacking into its networks in 2019.

Though the report was published this week, the hacking activities precede a warning in July from President Joe Biden about the growing likelihood of the US ending up in "a real shooting war with a major power" as a result of a cyber attack.

Speaking to Sky News previously - following then British defence secretary Gavin Williamson claiming that Moscow could cause "thousands and thousands and thousands" of deaths in the UK with a cyber attack - Mr Monrad cautioned that military responses to such an attack would requite a "very high certainty of attribution".

The new group, designated UNC 215 - meaning it is unclassified as either a state-sponsored group or one operating independently - also used the Hindi language and Arabic when targeting Uzbekistan.

FireEye's report stated: "This cyber espionage activity is happening against the backdrop of China's multi-billion-dollar investments related to the Belt and Road Initiative (BRI) and its interest in Israel's robust technology sector.

"China has conducted numerous intrusion campaigns along the BRI route to monitor potential obstructions [including] political, economic, and security," the company said, adding that it anticipates China will "continue targeting governments and organisations involved in these critical infrastructure projects".

The report follows the UK and allies accusing China of "systematic cyber sabotage" following an espionage operation earlier this year which also allowed criminals, potentially including those which Beijing used as contractors, to access the affected servers.

At the time, Chinese foreign ministry spokesman Zhao Lijian said: "The US ganged up with its allies and launched an unwarranted accusation against China on cybersecurity. It is purely a smear and suppression out of political motives. China will never accept this."

Newsletter

Related Articles

0:00
0:00
Close
Unelected PM of the UK holds an emergency meeting because a candidate got voted in… which he says is a threat to democracy…
Farmers break through police barriers in Brussels.
Ukraine Arrests Father-Son Duo In Lockbit Cybercrime Bust
US Offers $15 Million For Info On Leaders Of Cybercrime Group Lockbit
Apple warns against drying iPhones with rice
Alexei Navalny: UK sanctions Russian prison chiefs after activist's death
German economy is in 'troubled waters' - ministry
In a recent High Court hearing, the U.S. argued that Julian Assange endangered lives by releasing classified information.
Tucker Carlson says Boris Johnson wants "a million dollars, in Bitcoin or cash, from Tucker Carlson to talk about Ukraine.
Russia is rebuilding capacity to destabilize European countries, new UK report warns
EU Commission wants anti-drone defenses at Brussels HQ
Von der Leyen’s 2nd-term pitch: More military might, less climate talk
EU Investigates TikTok for Child Safety Concerns
EU Launches Probe Into TikTok Over Child Protection Under Digital Content Law
EU and UK Announce Joint Effort on Migration
Ministers Confirm Proposal to Prohibit Mobile Phone Usage in English Schools
Avdiivka - Symbol Of Ukrainian Resistance Now In Control Of Russian Troops
"Historic Step": Zelensky Signs Security Pact With Germany
"Historic Step": Zelensky Signs Security Pact With Germany
Russian opposition leader Alexey Navalny has died at the Arctic prison colony
Tucker Carlson grocery shopping in Russia. This is so interesting.
France and Germany Struggle to Align on European Defense Strategy
‘A lot higher than we expected’: Russian arms production worries Europe’s war planners
Greece Legalizes Same-Sex Marriage and Adoption Rights
Russia "Very Close" To Creating Cancer Vaccines, Says Vladimir Putin
Hungarian Foreign Minister: Europeans will lose Europe, the Union's policy must change drastically
Microsoft says it caught hackers from China, Russia and Iran using its AI tools
US Rejects Putin's Ceasefire Offer in Ukraine
The Dangers of Wildfire Smoke and Self-Protection Strategies
A Londoner has been arrested for expressing his Christian beliefs.
Chinese Women Favor AI Boyfriends Over Humans
Greece must address role in migrant vessel disaster that killed 600: Amnesty
Google pledges 25 million euros to boost AI skills in Europe
Hungarian President Katalin Novák Steps Down Amid Pardon Controversy
Activist crashes Hillary Clinton's speech, calls her a 'war criminal.'
In El Salvador, the 'Trump of Latin America' stuns the world with a speech slamming woke policing after winning a landslide election
Trudeau reacts to Putin's mention of Canadian Parliament applauding a former Ukrainian Nazi in his interview with Tucker Carlson.
The Spanish police blocked the farmers protest. So the farmers went out and moved the police car out of the way.
Volodymyr Zelenskiy fires top Ukraine army commander
Tucker Carlson's interview with Vladimir Putin raises EU concerns
Finnish Airline, Finnair, is voluntarily weighing passengers to better estimate flight cargo weight
Russia's Economy Expands by 3.6% Due to Increased Military Spending
Ukraine MPs Vote To Permit Use Of Dead Soldiers' Sperm
German Princess Becomes First Aristocrat To Pose Naked On Playboy Cover
UK’s King Charles III diagnosed with cancer
EU's Ursula von der Leyen Confronts Farmer Protests Amid Land Policy Debates
Distinguishing Between Harmful AI Media and Positive AI-Generated Content: A Crucial Challenge for the EU
Tucker Carlson explains why he interviewed Putin
Dutch farmers are still protesting in the Netherlands against the government, following the World Economic Forum's call for 'owning nothing.'
Hungarian Prime Minister Viktor Orbán stands up for European farmers and says, 'Brussels is suffocating European farmers.
×