Chinese hacking group targeted firms through IT MSPs

Security researchers have uncovered a cyber espionage operation that targeted companies through the managed service providers (MSPs).

PricewaterhouseCooper’s (PwC’s) cyber security practice has worked closely with BAE Systems and other members of the security community, along with the UK’s National Cyber Security Centre (NCSC), to uncover and disrupt what is thought to be one of the largest sustained global cyber espionage campaigns, dubbed Operation Cloud Hopper.

Since late 2016, PwC and BAE Systems have been collaborating to research the threat, brief the global security community and assist known victims. The threat actor behind the campaign is widely known in the security community as “APT10”, but referred to in PwC UK as “Red Apollo”.

According to the joint PwC/BAE report, APT10 has significantly increased its scale and capability since early 2016, including the addition of custom tools.

Researchers found that APT10 ceased its use of the Poison Ivy malware family after a 2013 FireEye report, which comprehensively detailed the malware’s functionality and features, and its use by several China-based threat actors, including APT10.

APT10 primarily used PlugX malware from 2014 to 2016, progressively improving and deploying newer versions, while simultaneously standardising their command and control function. However, researchers observed a shift towards the use of bespoke malware as well as open-source tools, which have been customised to improve their functionality, which is likely to indicate an increase in sophistication, the report said.

The espionage campaign has targeted managed MSPs, potentially allowing the APT10 group unprecedented access to the intellectual property and sensitive data of those MSPs and their clients around the world.

This campaign provides a useful reminder that an organisation’s entire supply chain needs to be managed and that organisations cannot outsource their risk, said the NCSC, adding that MSPs are particularly attractive to attackers because they often have highly privileged access to systems and data.

“As part of your procurement, you should have ensured that your service providers all manage their security to a level broadly equivalent to that you would expect from your internal functions. This incident provides a useful impetus to revisit those discussions,” the NCSC said.

According to the researchers, this indirect approach of reaching many through only a few targets demonstrates a new level of maturity in cyber espionage, underlining the importance of companies having a comprehensive view of all cyber threats, either directly or through their supply chain.

The researchers also uncovered a parallel campaign that targeted a number of Japanese organisations, with APT10 masquerading as legitimate Japanese government entities to gain access.

“This type of attack is not dissimilar from the Abta attack in March 2017 in that a supplier’s infrastructure was the target,” said Matt Walmsley, director at cyber security company Vectra Networks for Europe, Middle East and Africa.

“It highlights why companies need to support IT security professionals with technology that can help them spot the subtle nuances of a long game attack before valuable data is disrupted or walked out the door.

“A year from now, if these braches keep happening, companies in or working in the EU could also find themselves exposed to significant fines under GDPR [General Data Protection Regulation], as well as the long-term value destruction from loss of reputation and intellectual property,” he said.