Twelve Chinese Nationals Accused in Major U.S. Cyber Breaches

The United States Department of Justice (DOJ) has taken a firm stance by charging 12 individuals from China, asserting their involvement in a series of complex cyberattacks that targeted over 100 American entities, including the U.S. Treasury, dating back to 2013.

These individuals are alleged to have executed their cyber offenses independently or at the direction of two prominent Chinese government bodies: the Ministry of Public Security (MPS) and the Ministry of State Security (MSS). Of these accused, two are identified as MPS officers, and eight are linked to a so-called private Chinese enterprise, i-Soon. This company reportedly possessed the skills to infiltrate services like Gmail and Microsoft Outlook, alongside social media platforms such as Twitter and X. These tools were reportedly leveraged as part of a project called the 'Public Opinion Guidance and Control Platform,' designed to gauge international sentiment.

Completing the list of accused are members of a known hacking group, APT27, otherwise dubbed Silk Typhoon. This group has been implicated in breaching institutions like health systems and educational facilities, as noted by the DOJ. Recently, their cyber activities have concentrated on IT infrastructure, including management software, which were targeted in a significant Treasury attack last December.

Motivated by Financial Gains

According to the DOJ, financial incentives were a core motivating factor behind the hacks. The MPS and MSS allegedly offered substantial payments for stolen intelligence. Amongst the i-Soon group, the defendants supposedly amassed significant earnings as central figures in China's hire-for-hacking operations. i-Soon purportedly engaged in cyber intrusions on orders from the MPS and MSS, and at other times acted autonomously, selling stolen data to numerous MSS and MPS bureaus across China.

Remarkably, the fees for compromised email accounts ranged from $10,000 to $75,000 each. Beyond hacking, i-Soon also purportedly instructed MPS personnel in hacking techniques and marketed various cyberattack methods to their clientele.

Silk Typhoon's Extensive Impact

Despite diverse targets, Silk Typhoon's members, Yin and Zhou, are understood to have pursued financial gains aggressively. They left a trail of financial disruption within sectors as varied as tech enterprises, policy research institutions, legal firms, defense contractors, municipal bodies, healthcare systems, and universities across the United States, causing economic damages amounting to millions.

Additional entities impacted by i-Soon's cyber campaigns encompass two major New York-based newspapers, the U.S. Department of Commerce, and the Defense Intelligence Agency, among others.

Current State and Actions of U.S. Authorities

Currently, no suspects are in custody. In response, the U.S. government announced a reward of up to $10 million for intelligence that aids in pinpointing or apprehending those orchestrating or executing i-Soon's aggressive cyber operations. Furthermore, up to $2 million is offered for information leading to the arrests and convictions of Yin Kecheng and Zhou Shuai from Silk Typhoon, irrespective of the country of capture.