Perhaps the most remarkable of those new clues came from essentially hacking the hackers. CyCraft researchers observed the Chimera group exfiltrating data from a victim’s network and were able to intercept a authentication token from their communications to a command-and-control server. Using that same token, CyCraft’s analysts were able browse the contents of the cloud server, which included what they describe as a “cheat sheet” for the hackers, outlining their standard operating procedure for typical intrusions. That document was notably written in simplified Chinese characters, used in mainland China but not Taiwan.
The hackers also appeared to operate largely within Beijing’s time zone, to follow a “996” work schedule—the 9am to 9pm, six-days-a-week regimen common in the Chinese tech industry—and to take off Mainland Chinese holidays. Finally, CyCraft says they’ve learned from their cooperation with Taiwanese and foreign intelligence agencies that a hacker group using similar techniques also targeted Taiwanese government agencies.
Most specifically revealing, though, was the presence of one backdoor program on multiple victims’ networks that CyCraft says was previously used by the Winnti group, a large collection of hackers who have operated for over a decade and who are widely believed to be based in mainland China. In recent years, Winnti has become known for carrying out a mix of what appears to be state-sponsored hacking aligned with China’s interests and for-profit criminal hacking, often targeting videogame firms. In 2015, Symantec found that Winnti also appeared to be using skeleton key injection attacks like the kind CyCraft found used against the Taiwanese semiconductor companies. (CyCraft notes that it’s still not certain that Chimera is in fact Winnti, but considers it a likely possibility.)
Kaspersky, which first spotted and named the Winnti group in an investigation published in 2013, last year linked the group to an attack that hijacked the update mechanism for computers sold by Taiwan-based Asus. Costin Raiu, the director of Kaspersky’s Global Research & Analysis Team, says Winnti is responsible for other attacks on a broad range of Taiwanese companies beyond the semiconductor makers CyCraft has focused on, from telecoms to tech firms.
“It’s possible that what they’re seeing is just a small fragment of a larger picture,” Raiu says. Winnti isn’t unique among China-linked groups in their widespread targeting of Taiwan, Raiu adds. But he says Winnti’s innovative tactics, like the hijacking of Asus’s software updates, set them apart.
Even amidst China’s wholesale hacking of its island neighbor, though, CyCraft’s Duffy argues that the semiconductor industry represents a particularly dangerous target. Stealing chip schematics, he points out, could potentially allow Chinese hackers to more easily dig up vulnerabilities hidden in computing hardware. “If you have a really deep understanding of these chips at a schematic level, you can run all sorts of simulated attacks on them and find vulnerabilities before they even get released,” Duffy says. “By the time the devices hit the market, they’re already compromised.”
CyCraft concedes it can’t determine what the hackers are doing with the stolen chip design documents and code. And the more likely motivation of the hacking campaign is simply to give China’s own semiconductor makers a leg up over their rivals. “This is a way to cripple a part of Taiwan’s economy, to hurt their long-term viability,” Duffy says. “If you look at the scope of this attack, pretty much the entire industry, up and down the supply chain, it seems like it’s about trying to shift the power relationship there. If all the intellectual property is in China’s hands, they have a lot more power.”
Correction 8/7/2020 10:30 AM EST: This story has been updated to more accurately explain the skeleton key injection technique.
More Great WIRED Stories
