Chinese government using freelance hackers to compromise computer networks globally, FBI warns
The Chinese government is using freelance hackers and information security companies to compromise computer networks worldwide, FBI officials said in a public warning issued Wednesday.
The warning comes as indictments were unsealed in New York and Washington on Wednesday against a dozen Chinese nationals accused of hacking into American computer networks and selling stolen data to the Chinese government.
'The Department of Justice will relentlessly pursue those who threaten our cybersecurity by stealing from our government and our people,' Sue Bai, head of the Justice Department's National Security Division, said in a statement Wednesday.
'We are exposing the Chinese government agents directing and fostering indiscriminate and reckless attacks against computers and networks worldwide, as well as the enabling companies and individual hackers that they have unleashed,' Bai said. 'We will continue to fight to dismantle this ecosystem of cyber mercenaries and protect our national security.'
China's information security companies ecosystem 'flourishes' because China's government agencies 'weaponize' information security companies 'by tasking companies that advertise legitimate cybersecurity services to also use their expertise to gain unauthorized access to victim networks to collect for China's intelligence services,' FBI officials said in a statement.
The government agencies in China involved in the alleged cybersecurity threats include China's primary intelligence service, the Ministry of State Security, and China's domestic police agency, the Ministry of Public Security, according to the FBI.
The Southern District of New York on Wednesday unsealed an indictment against eight employees of Anxun Information Technology Co., Ltd., aka i-Soon, an information security company based in China, and two of China's domestic police officers who allegedly directed i-Soon activities 'in service of the Chinese government.'
'i-Soon has been a key player' in China's information security company ecosystem over the last decade, the FBI said. The company has been working with at least 43 separate Ministry of State Security or Ministry of Public Security bureaus in 31 provinces and municipalities across China.
The indicted i-Soon hackers allegedly sold stolen data to the Chinese government agencies 'from a myriad of victims, to include US-based critics of the Chinese government and Chinese dissidents, a US news organization, a large US-based religious organization, multiple governments in Asia, and US federal and state government agencies,' FBI officials said.
'i-Soon sold information to China's intelligence and security services to suppress free speech and democratic processes worldwide, and target groups deemed a threat to the Chinese government,' officials said.
i-Soon also sold platforms to China's primary intelligence service and domestic police agency customers 'for their own hacking efforts,' officials said.
i-Soon's activities are publicly tracked as Aquatic Panda, Red Alpha, Red Hotel, Charcoal Typhoon, Red Scylla, Hassium, Chromium, and TAG-22, according to the FBI.
'This ecosystem of InfoSec companies and freelance hackers enables and encourages indiscriminate global cyber activity, while providing the Chinese government with a layer of plausible deniability,' FBI officials said in their statement.
Also Wednesday, the federal court in Washington, D.C. unsealed two indictments of freelance Chinese hackers Yin KeCheng and Zhou Shuai, who are accused of maintaining ties to i-Soon and the Chinese government.
Since 2011, Yin and Zhou have worked in China's information security company ecosystem 'and enriched themselves by selling stolen US information to the Chinese government,' prosecutors allege.
Zhou served for a period of time in i-Soon's Strategic Consulting Division.
Yin, known in Chinese hacking circles for his prolific targeting of US entities, explained to an associate in 2013 that he wanted to 'mess with the American military' and 'break into a big target,' hoping the proceeds from selling the stolen US data would be enough to purchase a car, prosecutors allege.
At least one time, Yin compromised sensitive data which he turned over to Zhou, who partnered with an i-Soon employee to sell the stolen data, prosecutors said.
Yin and Zhou's activities are publicly tracked as APT27, Threat Group 3390, Bronze Union, Emissary Panda, Lucky Mouse, Iron Tiger, UTA0178, UNC 5221, and Silk Typhoon, officials said.
Anyone who suspects to be a victim of malicious cyber activity by groups associated with the government of China is urged to report the suspicious activity to the FBI's Internet Crime Complaint Center at www.IC3.gov as quickly as possible.
This is a developing story. Check back for updates as more information becomes available.
Download the FREE Boston 25 News app for breaking news alerts.
Follow Boston 25 News on Facebook and Twitter. | Watch Boston 25 News NOW
Try Our AI Features
Explore what Daily8 AI can do for you:
Comments
No comments yet...
Related Articles
CBS News
31 minutes ago
- CBS News
Men found guilty of supplying bomb that killed investigative journalist Daphne Caruana Galizia in Malta
Two men have been convicted in Malta of supplying the explosives that killed journalist Daphne Caruana Galizia in the Mediterranean island state in 2017. Following a six-week trial, Robert Agius, 41, and Jamie Vella, 42, were both found guilty late Thursday of complicity in the assassination of the 53-year-old investigative reporter by supplying the military-grade explosive used in the car bombing near her home. They're expected to be sentenced early next week, with prosecutors having asked for them to be given life in prison. The three hitmen who carried out the murder — brothers George and Alfred Degiorgio together with Vince Muscat — have already been convicted. Flowers and a candle lie in front of a portrait of slain investigative journalist Daphne Caruana Galizia during a vigil outside the law courts in Valletta, Malta, Tuesday, Oct. 16, 2018. Jonathan Borg / AP Agius and Vella were arrested four years after the murder, after Muscat agreed to testify against them in return for a reduced sentence in that case, and a pardon for a separate murder. Muscat was also the prosecution's key witness in the latest, in which more than 150 people testified before the jury, including relatives of Caruana Galizia, members of the FBI and a former government minister. The murder of Caruana Galizia, who had written about cronyism and sleaze within Malta's political and business elite, drew international outrage. There were also large protests in Malta against prime minister Joseph Muscat over his perceived efforts to protect friends and allies from the investigation. He announced his resignation in December 2019. A public inquiry published in 2021 found no evidence of state involvement in Caruana Galizia's assassination, but found the government created a "climate of impunity" for those who wanted to silence her. In a statement, the Caruana Galizia family said the latest convictions brought them "a step closer to justice." "Yet, eight years after Daphne's brutal assassination, the institutional failures that enabled her murder remain unaddressed and unreformed," they said. Caruana Galizia, who was called a "one-woman Wikileaks," had reported on allegations of money laundering, bribery and corruption in Malta for 30 years. She relentlessly pursued politicians in her home country on her blog, Running Commentary. "She knew that the powerful people that she was writing about were closing in on her," Galizia's son Paul told 60 Minutes after her death. "They were using every possible means to shut her down. She knew that, and that frightened her deeply." The Degiorgio brothers are serving 40 years each in prison for the murder, while Muscat received a reduced sentence of 15 years. Police and forensic experts inspect the wreckage of a car bomb that killed journalist and blogger Daphne Caruana Galizia close to her home in Bidnija, Malta, on October 16, 2017. STR/AFP via Getty Images Businessman Yorgen Fenech, who had close ties with Joseph Muscat's government, is still awaiting trial on charges that he masterminded the murder. He was arrested in November 2019 aboard his yacht as he tried to sail out of Malta. He was granted bail in January 2025, with no date yet set for his trial.
Yahoo
37 minutes ago
- Yahoo
US-German citizen charged with trying to bomb embassy building in Israel
A dual U.S. and German citizen was arrested in New York for allegedly attempting to firebomb a branch office of the U.S. Embassy in Tel Aviv, Israel, the Department of Justice said. Joseph Neumeyer, 28, was arrested by FBI special agents on May 25 at John F. Kennedy International Airport after being deported by Israeli authorities, the Justice Department said in a news release. He was charged with attempting to destroy, by means of fire or explosive, the U.S. Embassy, according to an unsealed criminal complaint filed in the Eastern District of New York. Neumeyer made an initial court appearance before a federal judge in New York City and was ordered detained, the Justice Department said. He faces a maximum of 20 years in prison and a $250,000 fine if convicted. "This defendant is charged with planning a devastating attack targeting our embassy in Israel, threatening death to Americans, and President Trump's life," Attorney General Pamela Bondi said in a statement. "The Department will not tolerate such violence and will prosecute this defendant to the fullest extent of the law." The arrest came just days after the fatal shooting of two Israeli embassy staff members in Washington, D.C. On the evening of May 21, Yaron Lischinsky and Sarah Lynn Milgrim were killed after leaving an event at the Capital Jewish Museum. The suspect in the shooting, Elias Rodriguez, 31, faces federal and local murder charges along with firearms offenses, authorities said on May 22. U.S. and Israeli officials have condemned the shooting, with Deputy FBI Director Don Bongino calling it an "act of targeted violence." In response to the incident, Israeli embassies immediately increased security measures, USA TODAY previously reported. 'Free Mahmoud': Columbia students boo university president at graduation over Palestinian activist arrest Neumeyer arrived in Israel in April, according to the complaint. He then allegedly traveled to the branch office of the U.S. Embassy in Tel Aviv on May 19 with a backpack containing three rudimentary improvised incendiary devices, known as Molotov cocktails, the complaint states. "Without provocation, Neumeyer spit on an Embassy guard as he walked past," the Justice Department said. "Neumeyer managed to break free as the guard attempted to detain him, leaving behind his backpack." Law enforcement officials in Israel searched the backpack, in which they discovered the Molotov cocktails, and later tracked Neumeyer to his hotel, according to the complaint. He was arrested and Israeli authorities returned him to the U.S. on May 25. A further investigation into Neumeyer revealed that earlier in the day on May 19, he posted on social media, saying "join me as I burn down the embassy in Tel Aviv. Death to America, death to Americans, and f---k the west," the complaint states. Federal prosecutors added that investigators believe a social media account used by Neumeyer also allegedly showed that he made posts threatening to assassinate President Donald Trump. What we know: Suspect in shooting outside Jewish museum in DC faces local, federal charges The recent incidents come amid growing criticism against Israel after it announced plans to intensify its military campaign against Hamas and to control Gaza, which has been devastated by air and ground operations. More than 53,000 people have been killed and nearly all residents in Gaza have been displaced since the start of the war, according to local health authorities. The war has increased tensions between Israel and much of the international community. Relations were further strained last week when Israeli soldiers fired warning shots near a diplomatic delegation in the occupied West Bank, with Italy and France both summoning Israeli ambassadors to explain what happened, according to Reuters. Incidents of antisemitism and Islamophobia in response to the war have also surged across the United States, putting law enforcement agencies on high alert. Advocacy groups have reported a record number of discrimination and hate incidents. Israeli Prime Minister Benjamin Netanyahu called the May 21 shooting "a despicable act of hatred, of antisemitism," saying the incident was connected to the increasingly hostile climate facing Israel over the war in Gaza. Netanyahu himself faces an arrest warrant from the International Criminal Court over alleged war crimes in Gaza, which Israeli politicians have condemned as part of a wider effort to delegitimize the state of Israel. Contributing: Reuters (This story was updated to correct a misspelling/typo.) This article originally appeared on USA TODAY: Man arrested for attempted bombing attack of the US embassy in Israel
Yahoo
38 minutes ago
- Yahoo
'Horrifying' Boulder attack comes amid rise in antisemitic crimes, Gaza tensions
A fiery assault targeting a group gathered to support Israeli hostages has rocked Boulder, Colorado, less than two weeks after two Israeli Embassy staff members were brazenly shot to death in Washington, DC, amid a rise in antisemitism incidents across the United States. Authorities on June 2 were investigating what the FBI called a "targeted terror attack" after a man a day earlier flung incendiary devices into the crowd and shouted "Free Palestine," setting eight people on fire. A suspect, identified by authorities as Mohamed Sabry Soliman, 45, was taken into custody. The violence erupted near a walk to remember the remaining Israeli captives in Gaza abducted by Hamas on Oct. 7, 2023. The victims, ages 52 to 88, had injuries ranging from serious to minor, authorities said. Colorado Attorney General Phil Weiser said the attack appeared to be a "hate crime given the group that was targeted." Weiser said the group meets weekly at the Pearl Street Mall in downtown Boulder to urge the release of the hostages held in Gaza. The gathering June 1 fell on the Jewish holiday of Shavuot. The attack comes at a time when tensions globally and in the United States have smoldered over the war between Israel and Hamas. After the Israeli Embassy slayings, embassies across the globe heightened security. Senate Minority Leader Chuck Schumer, a prominent Jewish Democrat, condemned the Boulder attack in a post on X. "This is horrifying, and this cannot continue. We must stand up to antisemitism." Colorado Gov. Jared Polis also blasted the incident as a "heinous act of terror. Hate-filled acts of any kind are unacceptable." In a statement on social media, the Boulder Jewish Community Center said it was in touch with law enforcement about the Jewish community in the city, noting that safety is the "highest priority." "We are saddened and heartbroken to learn that an incendiary device was thrown at walkers at the Run for Their Lives walk on Pearl Street as they were raising awareness for the hostages still held in Gaza," the Boulder Jewish Community Center said. Israeli Prime Minister Benjamin Netanyahu expressed solidarity with the victims who were attacked "simply because they were Jews. " On May 21, Yaron Lischinsky, 30, and his girlfriend Sarah Lynn Milgrim, 26, were gunned down in Washington as they exited the Capital Jewish Museum about a mile from the White House. Elias Rodriguez, 31, was charged with two counts of first-degree murder and was also facing several firearms charges and counts of killing foreign officials. Authorities said that the attack is being investigated as a hate and terrorism crime. Yechiel Leiter, Israeli ambassador to the United States, said the two victims killed were a "young couple about to be engaged." And just days after that shooting, a dual U.S. and German citizen was arrested in New York on charges of attempting to firebomb a branch office of the U.S. Embassy in Tel Aviv, authorities said. Colorado attack: Videos show chaotic scene after man set members of Boulder's Jewish community on fire Reports of incidents of antisemitism have continued to rise for a second year in a row, according to an annual report released by the Anti-Defamation League in April. ADL researchers counted 9,354 incidents of antisemitic assault, harassment, and vandalism across the country in 2024 − a 5% increase from 2023, which was also a record-breaking year. The number of incidents was the highest since the ADL started tracking antisemitism data in 1979. Israel's actions in Gaza, in response to the Oct. 7 Hamas attack − which killed 1,200 people, mostly civilians, and saw 251 taken as hostages into Gaza − has led to inflamed tensions throughout the United States. It also comes at a time when the Trump administration has detained pro-Palestinian protesters without charges and halted funding to certain U.S. universities that have been sites of Gaza protests. Israel's campaign has devastated much of Gaza, killing over 54,000 Palestinians and destroying most buildings. Contributing: Will Carless, Thao Nguyen, John Bacon and Reuters This article originally appeared on USA TODAY: Boulder, Colorado, attack comes amid inflamed Gaza tensions
