Graham Dietz, Microsoft Senior Security Researcher, joins Sherrod DeGrippo to discuss China's cyber activities, including patriotic hackers thriving in the underground, China's economic strategies related to cyber operations, and the complexity of Chinese cyber activities. They also explore China as an Advanced Persistent Threat, their loud presence, and targeting of vulnerable organizations.
China's cyber operations involve a wide range of activities, including targeting domestic individuals, diplomatic organizations, and performing industrial espionage to support its economic power.
China utilizes patriotic hackers to shape popular consciousness and patriotism, creating cultures hostile to targeted countries, and blurring the line between state-sponsored attackers and cyber criminal underground.
Deep dives
Overview of China's APT landscape
China's APT landscape is considered one of the top programs in terms of APT and nation-sponsored programs. China's robust program targets domestic individuals, diplomatic organizations, and performs industrial espionage to support its economic power. China's cyber operations are fueled by a large pool of hacking talent, which includes patriotic hackers and a thriving cyber criminal underground.
China's cyber activities and PLA units
China's cyber operations are heavily linked to its military, the People's Liberation Army (PLA). PLA units are involved in cyber warfare and offensive network operations. China has several units within the military that conduct these operations, including state-controlled programs. Attribution of specific incidents to these units is sometimes possible, but overall, China's cyber operations are not always highly sophisticated and can be attributed to a variety of actors.
China's patriotic hackers
China, like other countries, utilizes patriotic hackers for cyber operations. These hackers are individuals who have the capability to perform cyber attacks without direct state sponsorship. China leverages patriotic hackers through strategies that involve shaping popular consciousness and patriotism, creating cultures hostile to targeted countries. These hackers engage in a wide range of activities, from denial of service attacks to more sophisticated compromises of devices. There is a blurry line between patriotic hackers, state-sponsored attackers, and cyber criminal underground due to tool development and overlap in the use of hacking tools.
Chinese cyber crime and focus on edge devices
While China's cyber crime capability may not be as prominent as certain Eastern European operations, it does exist. China's cyber criminals are engaged in developing services, tools, and other resources to be used by other cyber criminals. China often focuses on compromising edge network devices as a stepping stone for later operations, but also conducts host-based malware attacks. China relies on a combination of off-the-shelf software and homegrown malware to achieve its objectives, prioritizing less attributable methods. The size and visibility of Eastern European operations often overshadow the cyber crime activities originating from China.
On this week's episode of The Microsoft Threat Intelligence Podcast, Sherrod DeGrippo is joined by Microsoft Senior Security Researcher Graham Dietz. Graham provides intelligence-led recommendations to improve cybersecurity posture in the future. They are creating customer-ready reports and presentations incorporating threat actor attribution, threat detection and hunting guidance, and remediation recommendations. Sherrod and Graham discuss China's extensive history in cyber operations, targeting domestic and international entities, including diplomatic organizations and industrial espionage.
In this episode you’ll learn:
How patriotic hackers are thriving inside the Chinese cybercrime underground
The complexity and diversity of Chinese cyber activities
China's economic strategies and how they relate to cyber operations
Some questions we ask:
What should someone do when handed an unknown USB device by a stranger?
Why does China target organizations without staying completely hidden?
What sets China apart as an advanced persistent threat?