{ "id": "430e79ae-17b6-48ec-af56-e6219af19629", "created_at": "2026-04-06T15:52:39.263692Z", "updated_at": "2026-04-10T13:12:34.382125Z", "deleted_at": null, "sha1_hash": "94a73dec311a3387d26b9c3e3c68fb29c4fdf242", "title": "Two Chinese Hackers Working with the Ministry of State Security Charged with Global Computer Intrusion Campaign Targeting Intellectual Property and Confidential Business Information, Including COVID-19 Research", "llm_title": "", "authors": "", "file_creation_date": "0001-01-01T00:00:00Z", "file_modification_date": "0001-01-01T00:00:00Z", "file_size": 52500, "plain_text": "Two Chinese Hackers Working with the Ministry of State Security\r\nCharged with Global Computer Intrusion Campaign Targeting\r\nIntellectual Property and Confidential Business Information,\r\nIncluding COVID-19 Research\r\nPublished: 2020-07-21 · Archived: 2026-04-06 15:24:14 UTC\r\nA federal grand jury in Spokane, Washington, returned an indictment earlier this month charging two hackers,\r\nboth nationals and residents of the People’s Republic of China (China), with hacking into the computer systems of\r\nhundreds of victim companies, governments, non-governmental organizations, and individual dissidents, clergy,\r\nand democratic and human rights activists in the United States and abroad, including Hong Kong and China.  The\r\ndefendants in some instances acted for their own personal financial gain, and in others for the benefit of the MSS\r\nor other Chinese government agencies.  The hackers stole terabytes of data which comprised a sophisticated and\r\nprolific threat to U.S. networks.\r\nThe 11-count indictment alleges LI Xiaoyu (李啸宇), 34, and DONG Jiazhi (董家志), 33, who were trained in\r\ncomputer applications technologies at the same Chinese university, conducted a hacking campaign lasting more\r\nthan ten years to the present, targeting companies in countries with high technology industries, including the\r\nUnited States, Australia, Belgium, Germany, Japan, Lithuania, the Netherlands, Spain, South Korea, Sweden, and\r\nthe United Kingdom.  Targeted industries included, among others, high tech manufacturing; medical device, civil,\r\nand industrial engineering; business, educational, and gaming software; solar energy; pharmaceuticals; defense.\r\n In at least one instance, the hackers sought to extort cryptocurrency from a victim entity, by threatening to release\r\nthe victim’s stolen source code on the Internet.  More recently, the defendants probed for vulnerabilities in\r\ncomputer networks of companies developing COVID-19 vaccines, testing technology, and treatments.\r\nThe charges were announced by Assistant Attorney General for National Security John C. Demers; FBI Deputy\r\nDirector David Bowdich; U.S. Attorney for the Eastern District of Washington William D. Hyslop; and Special\r\nAgent in Charge of the FBI’s Seattle Field Division  Raymond Duda.\r\n“China has now taken its place, alongside Russia, Iran and North Korea, in that shameful club of nations that\r\nprovide a safe haven for cyber criminals in exchange for those criminals being ‘on call’ to work for the benefit of\r\nthe state, here to feed the Chinese Communist party’s insatiable hunger for American and other non-Chinese\r\ncompanies’ hard-earned intellectual property, including COVID-19 research,” said Assistant Attorney General for\r\nNational Security John C. Demers.\r\n“Today’s indictment demonstrates the serious consequences the Chinese MSS and its proxies will face if they\r\ncontinue to deploy malicious cyber tactics to either steal what they cannot create or silence what they do not want\r\nto hear,” said FBI Deputy Director David Bowdich. “Cybercrimes directed by the Chinese government’s\r\nintelligence services not only threaten the United States but also every other country that supports fair play,\r\ninternational norms, and the rule of law, and it also seriously undermines China's desire to become a respected\r\nhttps://www.justice.gov/opa/pr/two-chinese-hackers-working-ministry-state-security-charged-global-computer-intrusion\r\nPage 1 of 3\n\nleader in world affairs. The FBI and our international partners will not stand idly by to this threat, and we are\r\ncommitted to holding the Chinese government accountable.”\r\n“The cybercrime hacking occurring here was first discovered on computers of the Department of Energy’s\r\nHanford Site in Eastern Washington.  As the grand jury charged, the computer systems of many businesses,\r\nindividuals and agencies throughout the United States and worldwide have been hacked and compromised with a\r\nhuge array of sensitive and valuable trade secrets, technologies, data, and personal information being stolen.  The\r\nhackers operated from China both for their own gain and with the assistance and for the benefit of the Chinese\r\ngovernment’s Ministry of State Security.  This prosecution is occurring as a result of the combined unwavering\r\nefforts of the National Security Division of the Department of Justice, the United States Attorney’s Office for the\r\nEastern District of Washington, and the Federal Bureau of Investigation.  We seek justice for these victims and\r\nothers affected and we intend to prosecute these defendants for their alleged crimes,” said U.S. Attorney William\r\nD. Hyslop for the District Eastern District of Washington.\r\n\"The complicated nature of cyber investigations is only exacerbated when the criminal is backed by the resources\r\nof a foreign government. The nature and value of the material stolen by these hackers cannot just be measured in\r\ndollars and was indicative of being state driven. This case demonstrates the FBI's dedication to pursuing these\r\ncriminals no matter who is sanctioning their activities,” said Special Agent in Charge Raymond Duda of the FBI’s\r\nSeattle Division.\r\nAccording to the indictment, to gain initial access to victim networks, the defendants primarily exploited publicly\r\nknown software vulnerabilities in popular web server software, web application development suites, and software\r\ncollaboration programs.  In some cases, those vulnerabilities were newly announced, meaning that many users\r\nwould not have installed patches to correct the vulnerability.  The defendants also targeted insecure default\r\nconfigurations in common applications.  The defendants used their initial unauthorized access to place malicious\r\nweb shell programs (e.g., the “China Chopper” web shell) and credential-stealing software on victim networks,\r\nwhich allowed them to remotely execute commands on victim computers.\r\nTo conceal the theft of information from victim networks and otherwise evade detection, the defendants typically\r\npackaged victim data in encrypted Roshal Archive Compressed files (RAR files), changed RAR file and victim\r\ndocuments’ names and extensions (e.g., from “.rar” to “.jpg”) and system timestamps, and concealed programs\r\nand documents at innocuous-seeming locations on victim networks and in victim networks’ “recycle bins.”  The\r\ndefendants frequently returned to re-victimize companies, government entities, and organizations from which they\r\nhad previously stolen data, in some cases years after the initial successful data theft.  In several instances,\r\nhowever, the defendants were unsuccessful in this regard, due to the efforts of the FBI and network defenders.\r\nThe indictment charges the defendants with conspiring to steal trade secrets from at least eight known victims,\r\nwhich consisted of technology designs, manufacturing processes, test mechanisms and results, source code, and\r\npharmaceutical chemical structures.  Such information would give competitors with a market edge by providing\r\ninsight into proprietary business plans and savings on research and development costs in creating competing\r\nproducts.\r\nThe defendants are each charged with one count of conspiracy to commit computer fraud, which carries a\r\nmaximum sentence of five years in prison; one count of conspiracy to commit theft of trade secrets, which carries\r\nhttps://www.justice.gov/opa/pr/two-chinese-hackers-working-ministry-state-security-charged-global-computer-intrusion\r\nPage 2 of 3\n\na maximum sentence of ten years in prison; one count of conspiracy to commit wire fraud, which carries a\r\nmaximum sentence of 20 years in prison; one count of unauthorized access of a computer, which carries a\r\nmaximum sentence of five years in prison; and seven counts of aggravated identity theft, which each carries a\r\nmandatory sentence of two non-consecutive years in prison.  The maximum potential sentences in this case are\r\nprescribed by Congress and are provided here for informational purposes only, as any sentencings of the\r\ndefendants will be determined by the assigned judge.\r\nThe investigation was conducted jointly by the U.S. Attorney’s Office for the Eastern District of Washington, the\r\nNational Security Division of the Department of Justice, and the FBI’s Spokane Resident Agency and San Antonio\r\nand Norfolk Field Offices.  The FBI’s Cyber Division assisted in the investigation and, along with  FBI’s Cyber\r\nAssistant Legal Attachés and Legal Attachés in countries around the world, provided essential support.  Numerous\r\nvictims cooperated and provided valuable assistance in the investigation.\r\nAssistant U.S. Attorney James Goeke of the Eastern District of Washington and Trial Attorney Scott McCulloch of\r\nthe National Security Division’s Counterintelligence and Export Control Section are prosecuting this case.  \r\nThe details contained in the charging document are allegations.  The defendants are presumed innocent until\r\nproven guilty beyond a reasonable doubt in a court of law.\r\nSource: https://www.justice.gov/opa/pr/two-chinese-hackers-working-ministry-state-security-charged-global-computer-intrusion\r\nhttps://www.justice.gov/opa/pr/two-chinese-hackers-working-ministry-state-security-charged-global-computer-intrusion\r\nPage 3 of 3", "extraction_quality": 1, "language": "EN", "sources": [ "Malpedia", "MISPGALAXY" ], "origins": [ "web" ], "references": [ "https://www.justice.gov/opa/pr/two-chinese-hackers-working-ministry-state-security-charged-global-computer-intrusion" ], "report_names": [ "two-chinese-hackers-working-ministry-state-security-charged-global-computer-intrusion" ], "threat_actors": [ { "id": "42a6a29d-6b98-4fd6-a742-a45a0306c7b0", "created_at": "2022-10-25T15:50:23.710403Z", "updated_at": "2026-04-10T02:00:05.281246Z", "deleted_at": null, "main_name": "Silence", "aliases": [ "Whisper Spider" ], "source_name": "MITRE:Silence", "tools": [ "Winexe", "SDelete" ], "source_id": "MITRE", "reports": null }, { "id": "aa73cd6a-868c-4ae4-a5b2-7cb2c5ad1e9d", "created_at": "2022-10-25T16:07:24.139848Z", "updated_at": "2026-04-10T02:00:04.878798Z", "deleted_at": null, "main_name": "Safe", "aliases": [], "source_name": "ETDA:Safe", "tools": [ "DebugView", "LZ77", "OpenDoc", "SafeDisk", "TypeConfig", "UPXShell", "UsbDoc", "UsbExe" ], "source_id": "ETDA", "reports": null }, { "id": "75108fc1-7f6a-450e-b024-10284f3f62bb", "created_at": "2024-11-01T02:00:52.756877Z", "updated_at": "2026-04-10T02:00:05.273746Z", "deleted_at": null, "main_name": "Play", "aliases": null, "source_name": "MITRE:Play", "tools": [ "Nltest", "AdFind", "PsExec", "Wevtutil", "Cobalt Strike", "Playcrypt", "Mimikatz" ], "source_id": "MITRE", "reports": null }, { "id": "eb5915d6-49a0-464d-9e4e-e1e2d3d31bc7", "created_at": "2025-03-29T02:05:20.764715Z", "updated_at": "2026-04-10T02:00:03.851829Z", "deleted_at": null, "main_name": "GOLD WYMAN", "aliases": [ "Silence " ], "source_name": "Secureworks:GOLD WYMAN", "tools": [ "Silence" ], "source_id": "Secureworks", "reports": null }, { "id": "88e53203-891a-46f8-9ced-81d874a271c4", "created_at": "2022-10-25T16:07:24.191982Z", "updated_at": "2026-04-10T02:00:04.895327Z", "deleted_at": null, "main_name": "Silence", "aliases": [ "ATK 86", "Contract Crew", "G0091", "TAG-CR8", "TEMP.TruthTeller", "Whisper Spider" ], "source_name": "ETDA:Silence", "tools": [ "EDA", "EmpireDNSAgent", "Farse", "Ivoke", "Kikothac", "LOLBAS", "LOLBins", "Living off the Land", "Meterpreter", "ProxyBot", "ReconModule", "Silence.Downloader", "TiniMet", "TinyMet", "TrueBot", "xfs-disp.exe" ], "source_id": "ETDA", "reports": null } ], "ts_created_at": 1775490759, "ts_updated_at": 1775826754, "ts_creation_date": 0, "ts_modification_date": 0, "files": { "pdf": "https://archive.orkl.eu/94a73dec311a3387d26b9c3e3c68fb29c4fdf242.pdf", "text": "https://archive.orkl.eu/94a73dec311a3387d26b9c3e3c68fb29c4fdf242.txt", "img": "https://archive.orkl.eu/94a73dec311a3387d26b9c3e3c68fb29c4fdf242.jpg" } }