TEL AVIV—Hackers have broken into the systems of more than a dozen global telecommunication companies and taken large amounts of personal and corporate data, researchers from a cybersecurity company said on June 25, identifying links to previous Chinese cyber-espionage campaigns.
Investigators at U.S.-Israeli cybersecurity firm Cybereason said the attackers compromised companies in more than 30 countries and aimed to gather information on individuals in government, law enforcement, and politics.
The hackers also used tools linked to other attacks attributed to Beijing by the United States and its Western allies, said Lior Div, chief executive of Cybereason.
“For this level of sophistication it’s not a criminal group. It is a government that has capabilities that can do this kind of attack,” he told Reuters.
Cybereason declined to name the companies affected or the countries they operate in, but people familiar with Chinese hacking operations said Beijing was increasingly targeting telcos in Western Europe.
Western countries have moved to call out Beijing for its actions in cyberspace, warning that Chinese hackers have compromised companies and government agencies around the world to steal valuable commercial secrets and personal data for espionage purposes.
Div said this latest campaign, which his team uncovered during the past nine months, compromised the internal IT network of some of those targeted, allowing the attackers to customize the infrastructure and steal vast amounts of data.
In some instances, they managed to compromise a target’s entire active directory, giving them access to every username and password in the organization. They also collected personal data, including billing information and call records, Cybereason said in a blog post.
“They built a perfect espionage environment,” said Div, a former commander in Israel’s military intelligence unit 8200. “They could grab information as they please on the targets that they are interested in.”
The United States indicted two alleged members of APT10 in December 2018 and joined other Western countries in denouncing the group’s attacks on global technology service providers to steal intellectual property from their clients. U.S. prosecutors said the two hackers had stolen hundreds of gigabytes of data from military service members, government agencies, and private companies in the United States and at least a dozen other countries.
Cybereason said on previous occasions it had identified attacks it suspected had come from China or Iran but it was never certain enough to name these countries.
“This time as opposed to in the past we are sure enough to say that the attack originated in China,” the company said.
“We managed to find not just one piece of software, we managed to find more than five different tools that this specific group used,” Div said.
