TECH

Chinese hackers want to steal Taiwanese data

Due to the coronavirus pandemic, this year's Black Hat cybersecurity conference was held as an online event. One of the conference participants was CyCraft, whose experts presented an interesting report on the results of the investigation into a series of incidents related to attacks on Taiwanese companies operating in the semiconductor industry.
Experts said at least seven Taiwanese semiconductor companies were attacked by hackers backed by the Chinese government. It is observed that attacks aimed at stealing intellectual property "harm corporations and interfere in business".
CyCraft did not release information on which Taiwanese companies were the target of attackers, but experts note that the attacks followed a similar scenario. It is not entirely clear what methods hackers used, but virtual private networks (VPNs) were hacked to penetrate internal systems. Then they used the Cobalt Strike tool to download malware disguised as a Google Chrome update. Hackers were good at disguising themselves and did not use software that could attract the attention of company security personnel.
CyCraft experts were able to intercept an authentication token on a remote server, which was used by cybercriminals to control malware. There they found several documents in Chinese, which indirectly indicate that hackers from the Middle Kingdom were behind the series of attacks.
“This is a way of damaging Taiwan's economy. If you look at the scale of this attack, which spans almost the entire industry, moving up and down the supply chain, it may appear that hackers are trying to shift the balance of power in that area. If all intellectual property is in the hands of China, they will have much more power, ”said a spokesman for CyCraft.

AVnews