Skip to main content

Attacks from Chinese hacking group have spiked, U.S. firm says

 

Attempted cyberattacks from a sophisticated Chinese hacking group have spiked since late January, according to cybersecurity firm FireEye Inc.

Recommended Videos

FireEye chief security architect Christopher Glyer said more than 75 of its customers were targeted in the attacks across more than a dozen countries, including the United States and Canada. The surge is “one of the broadest campaigns by a Chinese cyber espionage actor we have observed in recent years,” according to a post by FireEye on the cyberattacks.

“We haven’t seen something of this nature in at least three years,” Glyer told Digital Trends.

The group behind the attacks was identified as “APT41,” a China-based team made of contractors working on behalf of the Chinese government, Glyer said.

APT41 exploited flaws in Cisco and Citrix software to target firms across a variety of industries, including banking and finance, healthcare and construction firms.

The surge began on January 20 and lasted at least through March 11, with the group active as recently as this past week. Glyer said there could be numerous factors to explain the uptick in activity, such as the spread of coronavirus or the availability of a public exploit in the Cisco and Citrix software.

APT41, first flagged in 2012, is unique in that the hackers launched cyberattacks both to assist the Chinese government and for personal profit.

“There’s no other group that operates like that,” Glyer said.

In the past, APT41 has targeted telecommunications firms by planting malware that could effectively allow them to read individuals’ text messages or scan for keywords in text conversations, Glyer said.

“We’ve never seen any other group do that or have the sophistication to do that,” he said. “That’s incredibly rare.”

However, there isn’t evidence that the hacking group is using those methods during its recent spike in activity, he added.

It is the latest example of the spike in cyber crimes and attempted hacks that have been happening in and around the ongoing COVID-19 pandemic. With the added pressure of the virus and the change of routine for everyone, hackers are likely to take more advantage of people, security experts say. Already, reports have emerged of hackers posing as World Health Organization or Center for Disease Control officials in phishing attacks.

“From our perspective, we see these hacks all the time when there’s a vulnerability or data leak. The difference now is because of COVID-19 and coronavirus in the news, they [the hackers] are using it as part of their messaging,” said Dave Excell, the founder of Featurespace, a cybersecurity company that uses adaptive behavioral analytics to detect fraudulent activity.

The company works heavily in the financial sector, a space that’s seen a massive shift in the way people spend money, as everyone has moved inside and started using more credit cards online. “We’ve been as busy as ever with our customers, making sure they have the right defense in place as more people are going online to transact,” Excell told Digital Trends.

The World Economic Forum recently said that hackers are setting up fake coronavirus tracking websites and scraping the data from people who visited. In the U.K. victims lost more than 800,000 British pounds to a website promising to sell them protective face masks. Phishing attacks are on the rise, not in the least against the U.S. Department of Health and Human Services.

“If systems are already vulnerable, and the way of thinking is antiquated, and business and organizations don’t have proper protections in place to begin with, times like these will make us more vulnerable,” said Eric Bednash, CEO of RackTop Systems. “Whenever there’s a pandemic or a disaster, all of those things create added pressure, and extra opportunity for the bad guys.”

“Be extra diligent,” Bednash said, even as it might get harder to do so. “Everyone’s searching for ‘coronavirus tracker.’ Make sure you go to a reputable website. If you’re going to look up information on anything related to the pandemic, don’t click on links on your phone or computer that are not from well-known sources.”

Maya Shwayder
I'm a multimedia journalist currently based in New England. I previously worked for DW News/Deutsche Welle as an anchor and…
Google just gave vision to AI, but it’s still not available for everyone
Gemini Live App on the Galaxy S25 Ultra broadcast to a TV showing the Gemini app with the camera feature open

Google has just officially announced the roll out of a powerful Gemini AI feature that means the intelligence can now see.

This started in March as Google began to show off Gemini Live, but it's now become more widely available.

Read more
This modular Pebble and Apple Watch underdog just smashed funding goals
UNA Watch

Both the Pebble Watch and Apple Watch are due some fierce competition as a new modular brand, UNA, is gaining some serous backing and excitement.

The UNA Watch is the creation of a Scottish company that wants to give everyone modular control of smartwatch upgrades and repairs.

Read more
Tesla, Warner Bros. dodge some claims in ‘Blade Runner 2049’ lawsuit, copyright battle continues
Tesla Cybercab at night

Tesla and Warner Bros. scored a partial legal victory as a federal judge dismissed several claims in a lawsuit filed by Alcon Entertainment, a production company behind the 2017 sci-fi movie Blade Runner 2049, Reuters reports.
The lawsuit accused the two companies of using imagery from the film to promote Tesla’s autonomous Cybercab vehicle at an event hosted by Tesla CEO Elon Musk at Warner Bros. Discovery (WBD) Studios in Hollywood in October of last year.
U.S. District Judge George Wu indicated he was inclined to dismiss Alcon’s allegations that Tesla and Warner Bros. violated trademark law, according to Reuters. Specifically, the judge said Musk only referenced the original Blade Runner movie at the event, and noted that Tesla and Alcon are not competitors.
"Tesla and Musk are looking to sell cars," Reuters quoted Wu as saying. "Plaintiff is plainly not in that line of business."
Wu also dismissed most of Alcon's claims against Warner Bros., the distributor of the Blade Runner franchise.
However, the judge allowed Alcon to continue its copyright infringement claims against Tesla for its alleged use of AI-generated images mimicking scenes from Blade Runner 2049 without permission.
Alcan says that just hours before the Cybercab event, it had turned down a request from Tesla and WBD to use “an icononic still image” from the movie.
In the lawsuit, Alcon explained its decision by saying that “any prudent brand considering any Tesla partnership has to take Musk’s massively amplified, highly politicized, capricious and arbitrary behavior, which sometimes veers into hate speech, into account.”
Alcon further said it did not want Blade Runner 2049 “to be affiliated with Musk, Tesla, or any Musk company, for all of these reasons.”
But according to Alcon, Tesla went ahead with feeding images from Blade Runner 2049 into an AI image generator to yield a still image that appeared on screen for 10 seconds during the Cybercab event. With the image featured in the background, Musk directly referenced Blade Runner.
Alcon also said that Musk’s reference to Blade Runner 2049 was not a coincidence as the movie features a “strikingly designed, artificially intelligent, fully autonomous car.”

Read more