The defendants include two officers from China’s Ministry of Public Security (MPS), eight employees of Chengdu-based i-Soon Information Technology, and two members of the APT27 threat group (also known as Silk Typhoon or Emissary Panda). “Today’s announcements reveal that the Chinese Ministry of Public Security has been paying hackers-for-hire to inflict digital harm on Americans who criticize the Chinese Communist Party (CCP),” FBI Cyber Division Assistant Director Bryan Vorndran. The charges reveal an extensive, decade-long operation leveraging advanced malware like PlugX and HyperBro, exploitation of vulnerabilities such as CVE-2017-0213, and collaboration with Chinese security agencies to suppress dissent and steal sensitive data. APT27, active since at least 2010, has been linked to cyber espionage targeting defense, aerospace, and government sectors using custom tools like PlugX and QuarkBandit. However, leaked i-Soon marketing materials revealed contracts with over 43 Chinese security bureaus, underscoring the blurred lines between state and private-sector hackers. According to court documents, i-Soon operated as a “hacker-for-hire” entity, charging the MPS and Ministry of State Security (MSS) between $10,000 and $75,000 per compromised email inbox. The State Department announced $10 million rewards for information on i-Soon operatives and $2 million for APT27 members Zhou Shuai (“Coldface”) and Yin Kecheng. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. Concurrently, the Treasury’s Office of Foreign Assets Control (OFAC) sanctioned Shanghai Heiying Information Technology, a front company for Zhou Shuai, and blocked assets linked to the hacking campaigns. The indictments coincide with heightened U.S. efforts to counter Chinese cyber threats, including a House Select Committee hearing on bolstering critical infrastructure defenses. The group used DLL side-loading with a legitimate Google Updater executable (goopdate.dll) to deploy PlugX and Clambling malware while leveraging Mimikatz for credential harvesting and CVE-2017-0213 for privilege escalation. In one incident, APT27 actors exploited ProxyShell vulnerabilities (CVE-2021-26855, CVE-2021-34473) in Microsoft Exchange servers to deploy HyperBro, a memory-resident backdoor enabling remote command execution. Gurubaran is a co-founder of Cyber Security News and GBHackers On Security.
This Cyber News was published on cybersecuritynews.com. Publication date: Thu, 06 Mar 2025 05:55:11 +0000