U.S. charges 3 Chinese with hacking but stops short of blaming Beijing directly

[nitpicker]

http://www.mcclatchydc.com/news/nation-world/national/national-security/article186774098.html

U.S. charges 3 Chinese with hacking but stops short of blaming Beijing directly

By Tim Johnson

[e-mail]

November 27, 2017 06:17 PM

WASHINGTON — A federal grand jury in Pittsburgh charged three Chinese nationals with hacking and theft of trade secrets Monday for allegedly stealing data from corporate networks in the United States, a move that may become an irritant in U.S.-China relations in other areas. The three indicted individuals are employees of a cybersecurity firm in Guangzhou, a metropolis in southern China, and work closely with China’s Ministry of State Security.

The alleged hacking began in 2011 and continued until May of this year, according to the indictment. Three companies fell victim to the intrusions, including Moody’s Analytics, a major economic analysis firm. The others were Siemens AG, a German manufacturing and electronics conglomerate with U.S. operations, and Trimble Inc., a Sunnyvale, Calif., firm that provides specialized GPS technology, the document said.

The indictment shied from directly linking the Chinese government to the hacking, blaming only the private company, Guangzhou Bo Yu Information Technology Co. But a researcher at a U.S. cyber threat intelligence company, Recorded Future, said the Chinese company, called Boyusec for short, is a front operation for the Ministry of State Security and the indicted individuals are intelligence agents.
(snip)

The indictment said the three Chinese nationals -- Wu Yingzhuo, Dong Hao and Xia Lei – sought to steal commercial secrets and sensitive employee data by sending spearphishing e-mails to employees with malicious attachments or links to malware that facilitated access to the recipient’s computer. Then the hackers would install other tools on victims’ computers, sometimes using intermediary servers known as “hop points,” the indictment added. There was no immediate reaction from the individuals charged or the company that employs them.