Chinese Hackers Tried to Steal Russian Defense Data, Report Says

Under China’s authoritarian leader, Xi Jinping, Beijing has refined its approach to cyberspying, transforming over the past decade into a far more sophisticated actor. China’s premier spy agency, borrowing a page from Russia, has recruited beyond its ranks, pulling from the country’s growing pool of tech workers. The strategy has made its attacks more scattershot and unpredictable, but analysts say it has also helped strengthen the country’s efforts, enabling spies to run stealthy attacks that target intellectual property as well as political and military intelligence around the world.

Mr. Xi has made improving China’s scientific and technical capabilities a priority in the coming years, with ambitions of becoming a global leader in high-tech fields such as robotics, medical equipment and aviation. The campaign targeting Russian defense research institutes “might serve as more evidence of the use of espionage in a systematic and long-term effort to achieve Chinese strategic objectives in technological superiority and military power,” Check Point’s report said.

More recently, hackers based in China, like their counterparts elsewhere, have taken advantage of the war in Ukraine to break into the computer systems of organizations across Europe. Hackers have preyed upon heightened anxiety about the invasion, tricking their victims into downloading documents that falsely claim to contain information about the war or pose as aid organizations raising money for charity.

Many of the attacks originating from China appear to be focused on gathering information and intellectual property, rather than on causing chaos or disruption that could sway the conflict in favor of Ukraine or Russia, security researchers said.

In late March, Chinese hackers began going after Ukrainian organizations, according to security researchers and an announcement from Ukraine’s cybersecurity agency. A hacking team known as Scarab sent a document to Ukrainian organizations that offered instructions on how to film evidence of Russian war crimes but also contained malware that could extract information from infected computer systems, researchers at the security firm SentinelOne said.

Also in March, another hacking team affiliated with China, which security researchers have called Mustang Panda, created documents that purported to be European Union reports on conditions at the borders of Ukraine and Belarus, and emailed them to potential targets in Europe. But the documents contained malware, and victims who were tricked into opening them inadvertently allowed the hackers to infiltrate their networks, researchers at Google and the security firm Cisco Talos said.

The Mustang Panda hacking group had previously attacked organizations in India, Taiwan and Myanmar, but when the war started, it turned its focus to the European Union and Russia. In March, the hackers also pursued agencies in Russia, emailing them a document that appeared to contain information about the placement of border guards in Russia, Cisco Talos researchers said.