U.S. Accuses 12 Chinese Nationals of Hacking National Security Networks

The United States has taken significant steps to address the growing threat of Chinese cyber intrusions into U.S. government agencies and critical infrastructure.

On March 5, the U.S. Department of Justice (DOJ) indicted 12 Chinese nationals and one Chinese company on charges of malicious cyber activity.

This move marks an escalation in Washington’s efforts to combat aggressive forms of cyberwarfare orchestrated by the Chinese Communist Party.

Targeting U.S. Government Networks

The accused individuals are described as “cyber mercenaries,” receiving financial compensation from China’s Ministry of State Security (MSS) for successful hacks and analysis of stolen data.

Their targets included major U.S. government agencies such as the Defense Intelligence Agency, the Department of Commerce, and the Treasury.

Among those indicted are Zhou Shuai and Yin Kecheng, known hacking group Silk Typhoon members, which recently compromised a government contractor to infiltrate the Treasury’s networks.

Zhou and Yin allegedly stole sensitive data from U.S. critical infrastructure to benefit China’s defense sector as early as 2013.

The Treasury’s Office of Foreign Assets Control (OFAC) sanctioned both individuals, with Zhou added on March 5 and Yin previously sanctioned on January 17.

China’s Escalating Cyber Activities

The indictments highlight the close ties between Chinese cybercriminals and technology companies with the Chinese Communist Party.

The MSS provided specific data collection parameters to these hackers, focusing on telecommunications, border crossings, religious research, media, and civil service personnel.

This broad approach mirrors China’s ‘Thousand Grains of Sand’ intelligence strategy, prioritizing volume over quality in data collection.

According to the FDD reports, Microsoft recently issued a threat assessment warning that Silk Typhoon targets remote management tools and cloud services within the IT supply chain, aligning with the CCP’s expansive cyber ambitions.

While sanctions and indictments are crucial, they alone may not suffice. To counter China’s cyber threats effectively, the U.S. should consider stricter export controls and enhanced screening of outbound investments in the Chinese tech sector.

Implementing robust cybersecurity requirements for telecommunications firms and government contractors is also essential.

In cases where defense is insufficient, Washington should be prepared to launch countermeasures against Chinese hacking groups that compromise U.S. critical infrastructure. This firm stance is necessary to deter Beijing’s aggressive cyber activities.

The recent indictment underscores the complex interplay between Chinese cyber actors and official state agencies.

As U.S. cybersecurity policy evolves, it must address these deep-seated connections to protect national security interests effectively.

The U.S. action serves as a pivotal moment in ongoing efforts to combat cyber threats from China, emphasizing the need for both robust defense and strategic offense in the digital arena.

Are you from SOC/DFIR Teams? – Analyse Malware Incidents & get live Access with ANY.RUN -> Start Now for Free.