China accuses Taiwan of running five feeble APT gangs, with US help – Source: go.theregister.com

Beijing complains it’s under relentless attack by the equivalent of an ant trying to shake a tree China’s National Computer Virus Emergency Response Center on Thursday published a report in which it claims Taiwan targeted it with a years-long but feeble cyber offensive, backed by the USA.

In a report [PDF] titled “Operation Futile: Investigation report on Cyberattacks launched by ICEFCOM of Taiwan and its affiliated [advanced persistent threat] APT actors”.

The clumsy performance of the hacker groups is as ridiculous as an ant trying to shake a tree

“ICEFOM” is the acronym for Taiwan’s Information, Communications and Electronic Force Command, which the contested territory created in 2017. The report claims that Taiwan established ICEFCOM after the USA helped Taiwan’s pro-independence Democratic Progressive Party (DPP) ahead of the 2016 election in which it captured an outright majority for the first t Beijing’s thesis is that Taiwan’s people quietly yearn to re-unite with the mainland and that only US campaigns promoting independence for Taiwan could have created an environment in which the DPP won the 2016 election.

The report asserts that in the years since, the DPP and ICEFCOM have run five APT groups:

• APT-C-01 (Poison Vine)
• APT-C-62 (Viola Tricolor)
• APT-C-64 (Anonymous 64)
• APT-C-65(Neon Pothos)
• APT-C-67 (Ursa)

The report suggests activities of APT-C-01 and C-62 overlap, as both crews use phishing to attack government and scientific targets, then install malware and exfiltrate data.

China claims it first saw attacks by APT-C-64 in 2006, and that some of its members have worked to promote Taiwanese independence since the 1980s. The report says the crew tries to infiltrate websites, digital signage, and TV stations to display illegal content, but isn’t very effective.

“The actor aimed to gain control and post illegal content,” the report states, but its efforts “usually fall into the ‘honeypots’ set up by defenders” and members then lie about the effectiveness of their attacks by showing their masters faked websites.

APT-C-65 is said to use some tactics employed by C-62, but to focus on surveilling critical infrastructure during moments when US or Taiwanese politicians engage in major talks.

APT-C-67 targets video surveillance devices, using them to plant malware and gather “geographic intelligence.”

Slack hacks

The report’s authors think the APT groups have only “low-level” capabilities because they “mainly exploit known vulnerabilities” and have little ability to find new ones and don’t have reserves of zero-day attacks.

Another sign of their feebleness is heavy reliance on public resources” including free or open-source code, trojans, tools, and commercial penetration testing frameworks, as well as publicly available cyber attack techniques and tactics, lacking the ability to independently develop cyber weapons and tactics.”

“Third, their anti-tracing capabilities are weak, particularly in crafting lure documents and phishing web pages, which often contain numerous flaws, indicating a lack of expertise among the relevant groups and individuals, making attribution relatively easy.”

“The clumsy and low-level performance of the DPP authorities and their affiliate hacker groups is as ridiculous as an ant trying to shake a tree,” the report concludes. “It is meaningless except for embellishing their ‘Taiwan independence’ illusion. If they don’t pull back in time, they’ll reap the whirlwind.”

China’s National Computer Virus Emergency Response Center, National Engineering Laboratory for Computer Virus Prevention Technology, and software vendor 360 Digital Security Group co-authored the report. Readers may remember that they’ve also written reports in which China claims the USA hacked itself to discredit China.

That sort of argument – and news that Taiwan and the US are feeble cyberwarriors – presumably go down quite well in the Middle Kingdom. ®