APT40 explained
APT40, also known as BRONZE MOHAWK (by Secureworks),[1] FEVERDREAM, G0065, GADOLINIUM (formerly by Microsoft),[2] Gingham Typhoon[3] (by Microsoft), GreenCrash, Hellsing (by Kaspersky),[4] Kryptonite Panda (by Crowdstrike), Leviathan (by Proofpoint),[5] MUDCARP, Periscope, Temp.Periscope, and Temp.Jumper, is an advanced persistent threat operated by the Hainan State Security Department, a branch of the Chinese Ministry of State Security located in Haikou, Hainan, China, and has been active since at least 2009.
APT40 has targeted governmental organizations, companies, and universities in a wide range of industries, including biomedical, robotics, and maritime research, across the United States, Canada, Europe, the Middle East, and the South China Sea area, as well as industries included in China's Belt and Road Initiative.[6] APT40 is closely connected to Hafnium.[7]
History
On July 19, 2021, the U.S. Department of Justice (DOJ) unsealed an indictment against four APT40 cyber actors for their illicit computer network exploitation activities via front company Hainan Xiandun Technology Development Company.
In March 2024, the New Zealand Government and its signals intelligence agency Government Communications Security Bureau accused the Chinese government via APT40 of breaching its parliamentary network in 2021.[8] In July 2024, eight nations released a joint advisory on APT40.[9]
See also
Notes and References
- Web site: BRONZE MOHAWK | Secureworks . 2022-07-27 . 2022-07-02 . https://web.archive.org/web/20220702021337/https://www.secureworks.com/research/threat-profiles/bronze-mohawk . live .
- Web site: Microsoft Security—detecting empires in the cloud . . 24 September 2020 . 27 July 2022 . 27 July 2022 . https://web.archive.org/web/20220727142443/https://www.microsoft.com/security/blog/2020/09/24/gadolinium-detecting-empires-cloud/ . live .
- Web site: How Microsoft names threat actors . Microsoft . 21 January 2024 . 10 July 2024 . https://web.archive.org/web/20240710235817/https://learn.microsoft.com/en-us/defender-xdr/microsoft-threat-actor-naming . live .
- Web site: Hellsing Targeted Attacks . 13 January 2021 . 27 July 2022 . 27 July 2022 . https://web.archive.org/web/20220727142444/https://usa.kaspersky.com/resource-center/threats/hellsing-apt . live .
- Web site: Leviathan: Espionage actor spearphishes maritime and defense targets | Proofpoint US . 16 October 2017 . 27 July 2022 . 28 May 2022 . https://web.archive.org/web/20220528191942/https://www.proofpoint.com/us/threat-insight/post/leviathan-espionage-actor-spearphishes-maritime-and-defense-targets . live .
- Web site: Tactics, Techniques, and Procedures of Indicted APT40 Actors Associated with China's MSS Hainan State Security Department . National Cyber Awareness System . . 19 July 2021 . 19 July 2021 . 19 July 2021 . https://web.archive.org/web/20210719112743/https://us-cert.cisa.gov/ncas/alerts/aa21-200a . live .
- Web site: White House Says China's APT40 Responsible for Exchange Hacks, Ransomware Attacks -- Redmondmag.com . Mackie . Kurt . Redmondmag . July 19, 2021 . April 24, 2022 . May 17, 2022 . https://web.archive.org/web/20220517211043/https://redmondmag.com/articles/2021/07/19/china-apt40-exchange-attacks.aspx . live .
- News: Pearse . Adam . 26 March 2024 . Parliament systems targeted by China-based hackers . 28 March 2024 . . en-NZ . https://web.archive.org/web/20240326175340/https://www.nzherald.co.nz/nz/politics/new-zealand-parliament-systems-targeted-by-china-based-hackers/RNUEMYIZFBAILLCOJ7QMIUZJ5Y/. 26 March 2024. live.
- News: Cherney . Mike . July 9, 2024 . U.S., Allies Issue Rare Warning on Chinese Hacking Group . subscription . live . July 9, 2024 . . July 9, 2024 . https://web.archive.org/web/20240709180605/https://www.wsj.com/politics/national-security/u-s-allies-issue-rare-warning-on-chinese-hacking-group-9eebb0ce .
