A group of anonymous researchers have outed the APT17 cyber-attack group (aka DeputyDog) as a Chinese Ministry of State Security (MSS) operation, potentially paving the way for more US indictments.
Intrusion Truth have been right before, when they identified APT3 and APT10 as MSS groups: the former operated by a contractor known as Boyusec. These revelations led to Department of Justice indictments against some of the groups’ members in 2017 and 2018.
Now Intrusion Truth has identified a likely MSS officer, Guo Lin, who studied information security to Masters level and is affiliated with four private technology companies in the eastern city of Jinan.
The group also identified two hackers from Jinan – Wang Qingwei, who works at one of those four tech firms, and Zeng Xiaoyong (aka “envymask”).
Zeng is said to have submitted code used in a popular Chinese APT hacking tool known as ZoxRPC, which was subsequently developed into a newer tool, ZoxPNG (aka BLACKCOFFEE) by another Jinan hacker, Zhang Peng. ZoxPNG became a key part of multiple APT17 hacking campaigns, the blog post continued.
“Either, one of the authors of code in APT17’s primary malware just happens to be associated with a series of cybersecurity outfits that claim the MSS as their clients and are coincidentally managed by an MSS officer,” concluded Intrusion Truth. “Or, MSS Officer Guo Lin of the Jinan bureau of the Ministry of State Security manages APT17.”
China’s MSS is a sprawling, powerful intelligence agency that can be thought of as a combination of the FBI and CIA. That is, it deals with domestic affairs and foreign intelligence operations.
It is believed that hacking operations have increasingly been shifted from the PLA to this agency over the past few years, as attacks become more sophisticated.
Most recently it has been linked to the Marriott International breach, and a major two-year campaign targeting global telcos.
Washington is increasingly prepared to name and shame officers in indictments, although there’s little chance of them ever facing justice. This happened with charges issued in October last year related to a conspiracy to steal aviation secrets.
In a rare moment, US officials managed to arrest an alleged MSS officer in that same month, in connection with another plot to steal aviation secrets.