Chinese APT groups are targeting Linux servers

Research from Blackberry uncovers almost a decade of hacking from state-sponsored civilian contractors

Chinese-sponsored hackers have been targeting Linux servers in order to steal intellectual property, according to Blackberry researchers, and it's been happening for almost a decade.

A report from the Canadian company called 'Decade of the RATs' has revealed that five APT groups have been hacking into businesses via Linux servers, Windows systems and even Android mobiles.

The 'RATs' the report refers to is remote access trojans and the five groups have been using them to exploit the "always on, always available" nature of Linux servers by establishing a "beachhead" that can then be used for coordinated attacks.  

"As China forges its role as one of the great world powers, it continues to rely upon a blast furnace of cyber espionage operations in order to acquire foreign technologies and intellectual property, to better position itself against the global influence of competing international powers, and to control its own image both at home and abroad," the report states. 

According to the report, the five groups "acting in the interests of the Chinese government" have strategically targeted Linux servers because the OS is not a primary focus for enterprise security. It suggests that defensive coverage in this area is immature at best as endpoint protection products are either lack the capabilities to defend them or are "inadequately utilised".

Compromising Linux web servers in this way allows hackers to exfiltrate massive amounts of data that can be obscured within daily web traffic, according to the report. This both provides them with a chance to find valuable and sensitive data and also erases a layer of protection that corporate networks need. 

What's more, the groups are coordinating their attacks and are operating in a single domain, which the report suggests is rare. Although it doesn't name the groups specifically, it identifies them as civilian contractors and relations of the Winnti group. According to Kaspersky, the Winnti group has been active for several years but mostly focused on the online gaming industry. 

"This reflects a highly agile government/contractor ecosystem with few of the bureaucratic or legal hurdles that can be observed in Western nations with similar capabilities and provides a level of plausible deniability for the Chinese government," the report suggests. 

Featured Resources

How virtual desktop infrastructure enables digital transformation

Challenges and benefits of VDI

Free download

The Okta digital trust index

Exploring the human edge of trust

Free download

Optimising workload placement in your hybrid cloud

Deliver increased IT agility with the cloud

Free Download

Modernise endpoint protection and leave your legacy challenges behind

The risk of keeping your legacy endpoint security tools

Download now

Recommended

Nigerian cyber criminals target Texas unemployment system
cyber security

Nigerian cyber criminals target Texas unemployment system

27 May 2021
Hackers use open source Microsoft dev platform to deliver trojans
Security

Hackers use open source Microsoft dev platform to deliver trojans

14 May 2021

Most Popular

How to boot Windows 11 in Safe Mode
Microsoft Windows

How to boot Windows 11 in Safe Mode

6 Jan 2022
How to speed up Windows 11
Microsoft Windows

How to speed up Windows 11

7 Jan 2022
Financial regulators concerned about reliance on AWS, Azure and Google Cloud
IT regulation

Financial regulators concerned about reliance on AWS, Azure and Google Cloud

10 Jan 2022