Chinese Attackers Targeting U.S. Think Tanks, Researchers Say
The Chinese cyber attack group Deep Panda late last month compromised “several” national security think tanks with multiple, simultaneous, and sophisticated attacks designed to collect information about foreign policy decisions, according to researchers at security firm CrowdStrike.
Deep Panda, a group that has been attacking targets in the high-tech, financial services, and government arenas since 2009, was found to be cracking think tank systems to collect data on national security policy related to southeast Asia and the Middle East — two areas where international disputes heightened in June. CrowdStrike officials declined to name the think tanks or the exact details of the data that was compromised, but the attackers breached email, directories and files, they said.
Deep Panda had been collecting information primarily on U.S. policy in southeast Asia, but suddenly shifted direction and began collecting data about Iraq and Middle East policy, according to a blog posted on the CrowdStrike site this afternoon.
“This is undoubtedly related to the recent Islamic State of Iraq and the Levant (ISIS) takeover of major parts of Iraq, and the potential disruption for major Chinese oil interests in that country,” the blog says. “In fact, Iraq happens to be the fifth-largest source of crude oil imports for China and the country is the largest foreign investor in Iraq’s oil sector. Thus, it wouldn’t be surprising if the Chinese government is highly interested in getting a better sense of the possibility of deeper U.S. military involvement that could help protect the Chinese oil infrastructure in Iraq. In fact, the shift in targeting of Iraq policy individuals occurred on June 18, the day that ISIS began its attack on the Baiji oil refinery.”
The attacks were sophisticated, exploiting a vulnerability in Windows which allowed the group to deploy powershell scripts as scheduled tasks on Microsoft Windows machines, according to CrowdStrike. “The scripts are passed to the powershell interpreter through the command line to avoid placement of extraneous files on the victim machine that could potentially trigger AV- or Indicator of Compromise (IOC)-based detection,” the blog states.