Concerning behaviour

NCSC CEO Richard Horne said the organisation is “deeply concerned” by the “irresponsible behaviour of the named commercial entities”.

“It is crucial organisations in targeted critical sectors heed this international warning about the threat posed by cyber actors, who have been exploiting publicly known – and so therefore fixable – vulnerabilities,” he added. 

“In the face of sophisticated threats, network defenders must proactively hunt for malicious activity, as well as apply recommended mitigations based on indicators of compromise and regularly review network device logs for signs of unusual activity.” 

John Hultquist, chief analyst at Google Threat Intelligence Group, said: “Though there are many Chinese cyber espionage actors regularly targeting the sector, this actor’s familiarity with telecommunications systems gives them a unique advantage, especially when it comes to evading detection.

“Many of the highly successful Chinese cyber espionage actors we encounter have deep expertise in the technologies used by their targets, giving them an upper hand.”

He said an ecosystem of contractors, academics and other facilitators are at the heart of Chinese cyber espionage. “Contractors are used to build tools and valuable exploits as well as carry out the dirty work of intrusion operations,” said Hultquist. “They have been instrumental in the rapid evolution of these operations and growing them to an unprecedented scale.”

In April, the NCSC and partners issued advisories alerting individuals considered to be of interest to the Chinese intelligence services to two spyware variants, dubbed Moonshine and BadBazaar.

The spyware variants both employ a technique known as trojanising, whereby they hide their malicious functionality inside apparently legitimate applications to access device functions such as microphones and cameras, location data, messages and photos.

Last year, the NCSC and its counterpart, Five Eyes, accused a China-based company acting as a front for the state of running a massive botnet comprising over 250,000 internet-connected devices, about 8,500 of them located in the UK.

The compromised devices include enterprise network and security tools such as routers and firewalls, and internet of things (IoT) products such as CCTV cameras and webcams. Unbeknownst to their owners, they are being used to conduct coordinated cyber attacks, including distributed denial of service attacks and malware delivery.