FOLLOW US

Google-owned security company   Mandiant issued a report on Thursday. The report expressed “high confidence” that the group exploiting a software vulnerability in Barracuda Networks’ Email Security Gateway was engaged in “espionage activity in support of the People’s Republic of China. And that the hack compromised tens of thousands of computers globally.

Mandiant describes a massive hack

”Suspected state-backed Chinese hackers used a security hole in a popular email security appliance to break into the networks of hundreds of public and private sector organizations globally, nearly a third of them were government agencies including foreign ministries.

“This is the broadest cyber espionage campaign known to be conducted by a China-nexus threat actor since the mass exploitation of Microsoft Exchange in early 2021,” Charles Carmakal, Mandiant’s chief technical officer, said in an emailed statement. 

Mandiant's report highlights the broad scope of the cyber espionage campaign orchestrated by the China-nexus threat actor.

The hackers used a security hole in a popular email security appliance to infiltrate the networks of numerous public and private organizations worldwide.

 Approximately one-third of the targeted entities were government agencies, including foreign ministries.  Carmakal, described the campaign as the most extensive cyber espionage activity attributed to a China-linked group since the mass exploitation of Microsoft Exchange earlier in 2021.

The hackers used SALTWATER aka Seaspy malware. They sent malicious file attachments via email to gain unauthorized access to targeted organizations' devices and data. SALTWATER can upload or download arbitrary files, execute commands, and has proxy and tunneling capabilities. 

The report reveals that the attacks predominantly targeted organizations in the Americas, accounting for 55% of the victims. Asia Pacific accounted for 22%, while Europe, the Middle East, and Africa comprised 24% of the targeted entities. 

Foreign ministries in Southeast Asia, foreign trade offices, and academic organizations in Taiwan and Hong Kong were also affected. Mandiant's investigation linked the attacks to Chinese-linked hackers, who targeted public agencies, schools, and high-value information targets across the globe.

The severity of the breach led Mandiant to recommend a complete replacement of the affected appliances. 

China denies responsibility 

China’s government on Friday rejected the U.S. security firm report.

A foreign ministry spokesperson repeated accusations that Washington carries out hacking attacks and complained the cybersecurity industry rarely reports on them.

“The relevant content is far-fetched and unprofessional,” said the Chinese spokesperson, Wang Wenbin.

“American cybersecurity companies continue to churn out reports on so-called cyberattacks by other countries, which have been reduced to accomplices for the U.S. government’s political smear against other countries,” Wang said.

Mandiant’s report came ahead of a visit to Beijing by Secretary of State Antony Blinken aimed at repairing relations that have been strained by disputes over human rights and security.

The Blinken visit was planned for earlier this year. And was canceled after the U.S. shot down what it says was a Chinese spy balloon over the United States.