{"id":5614,"date":"2020-10-08T09:09:49","date_gmt":"2020-10-08T16:09:49","guid":{"rendered":"https:\/\/blogs.infoblox.com\/?p=5614"},"modified":"2023-10-12T13:52:05","modified_gmt":"2023-10-12T20:52:05","slug":"cisa-alert-domain-registration-hacking-by-chinese-threat-groups","status":"publish","type":"post","link":"https:\/\/www.infoblox.com\/blog\/security\/cisa-alert-domain-registration-hacking-by-chinese-threat-groups\/","title":{"rendered":"CISA Alert – Domain Registration Hacking by Chinese Threat Groups"},"content":{"rendered":"

The Cybersecurity and Infrastructure Security Agency (CISA) put out Alert AA20-275A on 10.1.2020 on the Potential for China Cyber Response to Heightened U.S. – China Tensions. <\/span>The genesis of the alert is increasing tensions between the United States and China. The alert declares that \u201cChina has a history of using national military and economic resources to leverage offensive cyber tactics in pursuing its national interests.\u201d<\/span><\/p>\n

The \u201cMade in China 2025\u201d 10-year plan defines some of China\u2019s policy priorities. Per the CISA alert, China may seek to target industries that are core to U.S. interests. These industries include new energy vehicles (electric, fuel cell, hydrogen, etc.), next-generation information technology (IT), biotechnology, new materials, aerospace, maritime engineering and high-tech ships, railway, robotics, power equipment, and agricultural machinery.<\/span><\/p>\n

The U.S. intelligence community and various private industry organizations have repeatedly identified the Chinese People\u2019s Liberation Army (PLA) and the Ministry of State Security (MSS) as behind a history of Chinese state-sponsored cyberattacks. There are examples of the PLA and the MSS managing these attacks directly and using designated proxy contractors in the Chinese business community.\u00a0<\/span><\/p>\n

Many Years of Documented Malicious Activity<\/span><\/h3>\n

These Chinese Government-sponsored malicious activities have gone on for years. In 2014, the Zombie Zero\u00b9<\/span> supply-chain attack targeted shipping and logistics firms by implanting malware in brand new scanner hardware manufactured in China. Once a particular supply chain was compromised, the perpetrators could make orders in the database appear and disappear at will. In Zombie Zero, a Chinese government-sponsored private industry contractor embedded all newly manufactured scanner hardware with malicious firmware. The malware allowed the setup of command and control directly to the supply chain software. This allowed the threat actors to track virtually all shipments to and from each of the organizations compromised by these devices.\u00a0<\/span><\/p>\n

The CISA alert cites other examples of the very long history of Chinese threat actors involved with much offensive cyber activity. Those mentioned in the CISA alert include:<\/span><\/p>\n