China Suspected Behind Five Year Cyberattack Campaign

Posted 08/03/2011 at 8:13am | by Paul Lilly

31

Comments

Print

Security firm McAfee on Tuesday published the results of "Operation Shady RAT" (where RAT stands for Remote Access Tool), which the company describes as "the most comprehensive analysis ever revealed of victim profiles from a five year operation by one specific actor." McAfee said it traced several cyber shenanigans back to a single server used by the intruders to hack into 72 organizations, including offices of the Associated Press, governments of the United States, the United Nations, and others agencies around the world.

McAfee chose not to go out on a limb and name the "specific actor" it references, though according to a report in The New York Times, those entrenched in the security scene tell the news outlet the Chinese government has in place a cyber battalion of sorts ready to do battle on the Web. And it's not just security gurus chirping to NYT. James Lewis, a senior fellow and director of the Technology and Public Policy Program at the Center for Strategic & International Studies (CSIS) tells Australia's The Sydney Morning Herald "the most likely candidate is China" based on his analysis of the targets. Regardless of where the attacks originated from, there's a ton of data changing hands.

"What we have witnessed over the past five to six years has been nothing short of a historically unprecedented transfer of wealth — closely guarded national secrets (including from classified government networks), source code, bug databases, email archives, negotiation plans and exploration details for new oil and gas field auctions, document stores, legal contracts, SCADA configurations, design schematics and much more has 'fallen off the truck' of numerous, mostly Western companies and disappeared in the ever-growing electronic archives of dogged adversaries," McAfee explains.

McAfee isn't exaggerating and says the amount of stolen data adds up to petabytes, though what exactly it's being used for "is still largely an open question." According to McAfee, the culprits could use this data to get the jump on building competing products (or build better ones), or gain the upper hand during business negotiations. Either way, McAfee says "the loss represents a massive economic threat not just to individual companies and industries but to the entire countries that face the prospect of decreased economic growth in a suddenly more competitive landscape and the loss of jobs in industries that lose out to unscrupulous competitors in another part of the world, not to mention the national security impact of the loss of sensitive intelligence or defense information."

You can read the entire detailed report here.