Ten Country Intelligence Agencies Say Chinese Groups Use Routers and Smart Fridges to Build Botnets
Chinese government hackers have taken over tens of thousands of everyday Internet of Things (IoT) devices, such as home internet routers and smart refrigerators, to build a massive ‘zombie network’, and are using it to steal core secrets from Western countries. [Image source: gettyimagesbank]
Chinese government hackers have seized control of tens of thousands of everyday Internet of Things (IoT) devices including home internet routers and smart refrigerators to construct a massive “zombie network,” which they are then using to steal critical secrets from Western nations, the Financial Times (FT) reported on April 24 (local time). Western intelligence agencies, which had long regarded China as a “second-tier cyber threat” trailing Russia, now assess that China has nearly closed that gap.
Intelligence agencies from 10 countries including the five members of the “Five Eyes” intelligence alliance (the United States, the United Kingdom, Australia, Canada, and New Zealand) along with Germany, Japan, the Netherlands, Spain, and Sweden jointly issued an advisory on that day concerning Chinese hackers. The advisory stated that Chinese hackers’ tactics have evolved, making them increasingly difficult to detect, and that their success rate in stealing classified information and launching cyberattacks against critical infrastructure such as power plants and telecommunications networks continues to rise.
The key mechanism is the “botnet,” a covert network composed of compromised devices. The UK’s National Cyber Security Centre (NCSC) noted that “China-affiliated cyber actors have begun deploying these botnets strategically and at scale.”
Tens of thousands of home routers and internet-connected devices around the world have been compromised by Chinese hackers, with analysts attributing the vulnerability to the tendency of individuals and companies to neglect software updates after purchasing their devices.
Previously, botnets targeting IoT devices were primarily used for relatively straightforward attacks such as denial-of-service (DoS). However, European intelligence officials explained that in this instance, compromised devices are being strung together like a “chain” to conceal far more sophisticated intrusions. This renders ineffective the conventional defensive approach, in which IT professionals identify and block servers or IP addresses that repeatedly serve as attack sources.
The Five Eyes had warned last month that Russia was also engaging in hacking of home routers. However, the joint advisory assessed that “China’s approach is far more extensive.”
The advisory identified all three of China’s most powerful cyber units like Volt Typhoon, Flax Typhoon and Violet Typhoon as those having transitioned to this botnet method.
Volt Typhoon and Flax Typhoon are organizations linked to China’s People’s Liberation Army (PLA) and have focused heavily on targeting U.S. telecommunications networks. Flax Typhoon, in particular, concentrates on hacking Taiwanese computer networks and U.S. military systems related to Taiwan. U.S. intelligence officials assess their core objective to be “preemptively disabling military and civilian systems so that the United States would find it difficult to respond in the event that China invades or attacks Taiwan.”
Violet Typhoon operates under China’s Ministry of State Security (MSS) and has targeted political and government institutions across Europe and the United States. In 2021, it targeted the UK’s Electoral Commission and members of parliament. Germany’s Federal Office for the Protection of the Constitution (BfV) stated that “since late 2018, this organization has primarily used compromised devices within Germany to attack political institutions in Western countries, including ministries, authorities, and foundations.”
The Chinese Embassy in the United Kingdom did not respond to a request for comment, the FT reported.
Kim Eun-jin
댓글
0