For years, a group of Chinese hackers known variously as Barium, Winnti, or APT41 has carried out a unique mix of sophisticated hacking activities that has puzzled the cybersecurity researchers tracking them. At times they appear focused on the usual state-sponsored espionage, believed to be working in the service of the Chinese Ministry of State Security. At other times their attacks looked more like traditional cybercrime. Now a set of federal indictments has called out those intruders by name, and cast their activities in a new light.
Five Chinese hackers are accused of a sprawling scheme to break into the networks of hundreds of global companies in a broad range of industries, as well as think tanks, universities, foreign government agencies, and the accounts of Hong Kong government officials and pro-democracy activists. The victims are located in a dozen Asian countries as well as the US, France, Australia, the United Kingdom, and Chile. The Department of Justice says that the hackers, employed by a company called Chengdu 404 Network Technology, allegedly hit dozens of private companies to steal millions of dollars, sometimes using ransomware schemes or cryptojacking, malware that exploits compromised computers to generate cryptocurrency. In many cases, the hackers used a rare and brazen technique known as supply chain attacks to plant their malicious code in legitimate software used by their targets.
But the most detailed element of the alleged schemes revealed in the indictments is the targeting of nine video game firms. The victims go unnamed, but are based in the US, France, South Korea, Japan, and Singapore. Court documents describe how the attackers used supply chain attacks and spear-phishing to infiltrate those companies' networks. They used that access to generate in-game goods and artificially inflate the virtual currency balances of accounts controlled by two Malaysian men, Wong Ong Hua and Ling Yang Chua, who would then allegedly sell the hacker-created items and currency on a market they controlled called SEA Gamer. The DOJ says it's currently seeking the extradition of both men.
"We see this as unfortunately a new area in which hackers are exploiting, and its a billion-dollar industry," Acting US Attorney for the District of Columbia Michael Sherwin said of the video game firm targeting in a Justice Department's press conference Wednesday. "Im sure this isnt the end."
The charges mark the second time in just two months that the DOJ has charged Chinese hackers with a hybrid collection of state-sponsored spying and cybercriminal hacking. "Ive been up here too many times now announcing charges against hackers working at the behest of the Chinese government or, at the very least, with the Chinese governments tacit approval," FBI deputy director David Bowdich at Wednesday's press conference. "Were here today to tell these hackers and the Chinese government officials who turned a blind eye to their activity that their actions are once again unacceptable, and we will call them out publicly."