Profile: Arrested Chinese Cyber Actor Yu Pingan

TLP AMBER ANNOUNCEMENT: 

On 22 August 2017, a Chinese national named Yu Pingan was arrested and charged with cyber intrusions into four U.S. corporations between 2011 and 2014 that included the use of Sakula malware, known for its use in the major breaches of Anthem patient records and the Office of Personnel Management (OPM). Yu Pingan operates under the principle persona “Goldsun.” Analysts believe (high confidence) that he is in fact the Goldsun that was active at the Chinese hacker website Xfocus.net from 2004 to 2009. He is credited with and likely authored several pieces of malware that he posted during this period. His real identity remained unknown, but email addresses in some of his posts correspond to other accounts identified in the charges that led to his arrest. The charges against Yu Pingan do not identify any organization he was working for nor any connection to the Chinese government. Wapack Labs believes with medium confidence that Yu is affiliated with the Chinese civilian hacker group Wekby. The Chinese Government has not issued any statements and there has been no coverage of his arrest in official media...READ MORE

Wapack Labs has cataloged and reported extensively on China, Wekby, APT, and cyber intrusions in the past. An archive of related reporting can be found in the Red Sky Alliance portal.

WWW.WAPACKLABS.COM

This TLP AMBER report is available only to Red Sky Alliance members.

Sanctioned ANO PO KSI: Surveillance and Ballot Reading

The Autonomous Noncommercial Organization Professional Association of Designers of Data Processing Systems (ANO PO KSI) was sanctioned by the U.S. in response to Russian interference in the 2016 U.S. Presidential election. The company works with the Russian Defense Ministry, FSB, and other government organizations. They produce election ballot and census form scanners, and aero-surveillance cameras...READ MORE

Wapack Labs has extensively reported on election interference in the past. An archive of related reporting can be found in the Red Sky Alliance portal.

TLP: GREEN
ACTOR TYPE: (V)
SERIAL: TAR-17
COUNTRIES: RU, U.S.
INDUSTRIES: Military, Political

REPORT DATE: 20170306

Fake News and Social Media

The liberation of publishing from traditional media outlets has created opportunities for individuals to practice the art of news reporting, with mixed results. For every legitimate attempt at disseminating factual information, faux reporters traffic in “fake news” in order to increase their popularity rather than report accuracy. Apple executive Tim Cook recently expressed a need for a “massive campaign” to raise awareness of this problem, as fake news has or is influencing elections in the U.S., Russia, the Ukraine, France and other countries. Combatting fake news will require not only the active participation of media outlets, but an emphasis in national education systems on critical thinking skills. 

Wapack Labs has reported on fake news in the past. An archive of related reporting can be found in the Red Sky Alliance Portal.

The following organizations were cited in this report: Apple

TLP: AMBER
ACTOR TYPE: (IV)
SERIAL: TR-036-2017
COUNTRIES: US, RU, UA, FR
INDUSTRIES: ALL
REPORT DATE: 20170214

Cyber Targeting the Maritime Economy

securityaffairs.co

In the 1990’s the Irish Mafia, traditional La Cosa Nostra operatives, the Hell’s Angels and corrupted port workers controlled the Port of Montreal.  This port was a gateway to both rail and highway transportation for eastern and central Canada and much of the U.S.  Their method of operation was basically accomplished by hardline phones (some cell phones), fax machines and old fashion extortion, corruption and hostile intimidation.  They were very successful for many years.  Imagine now, 2016, the current digital landscape and the vast network of bad actors has enhanced their bent on both criminal and terrorist port targeted agendas.  

Wapack Labs CEO J. Stutzman trusts that since our service has worldwide data connections, there is a very high probability that we possess maritime industry account information which would indicate data - exposing bad actors tracking ships and shipment information.  This in reality has already been proven by Wapack Labs through innovative collection and analysis methods.  This information is being supplied for your situational awareness; with more to follow. 

Publication date:                             15 September 2016

Handling requirements:                   Traffic light protocol (TLP) GREEN

Attribution/Threat Actors:               Port cyber compromise

Actor Type:                                      Tier III to IV          

Potential Targets:                             USA / International

Past Reporting:                                 DOC-3881, DOC-4204

The full attribution report has been published in its entirety in the Red Sky Alliance portal.  For more information please contact the lab directly at 844-4-WAPACK, 603-606-1246, or feedback@wapacklabs.com.

About Wapack Labs

Wapack Labs, located in New Boston, NH is a Cyber Threat Analysis and Intelligence organization supporting the Red Sky Alliance, the FS-ISAC and individual organizations by offering expert level targeted intelligence analysis answering some of the hardest questions in Cyber.  Wapack Labs’ engineers, researchers and analysts use deep analysis techniques and visualization to design and deliver transformational cyber-security analysis tools that fuse open source and proprietary information.  The intelligence derived from these tools and techniques serve as the foundation of Wapack Labs’ information reporting to the cyber-security teams of its customers and industry partners located around the world.

Hacking the U.S. Elections

www.cnn.com

Last month, Wapack Labs reported on voter fraud issues in the U.S.  This past weekend, our CEO reiterated these same concerns in his blog.  This worry is real and could affect the integrity of the U.S. electoral process; and thus effect any aspects of U.S. and international corporate and government relations.  Though voter fraud has been a reality for many years, the fear of foreign and or domestic IT hacking is a true concern.  A series of data breaches overseas are spurring concerns that hackers could manipulate elections in the United States.  Many U.S. states do not have proper paper backups to properly cross reference voting records if their electronic systems are hacked or fail.  With heightened sensitivity regarding U.S. voter fraud and electronic voting machines, further OSINT research was conducted.   This information is being supplied for your situational awareness. 

Publication date:                          12 September 2016

Handling requirements:                Traffic light protocol (TLP) GREEN

Attribution/Threat Actors:            US POTUS Voter Fraud

Actor Type:                                   Tier III to IV          

Potential Targets:                         USA

Past Reporting:                             DOC-4174, DOC-4144, DOC-2145

The full attribution report has been published in its entirety in the Red Sky Alliance portal.  For more information please contact the lab directly at 844-4-WAPACK, 603-606-1246, or feedback@wapacklabs.com.

About Wapack Labs

Wapack Labs, located in New Boston, NH is a Cyber Threat Analysis and Intelligence organization supporting the Red Sky Alliance, the FS-ISAC and individual organizations by offering expert level targeted intelligence analysis answering some of the hardest questions in Cyber.  Wapack Labs’ engineers, researchers and analysts use deep analysis techniques and visualization to design and deliver transformational cyber-security analysis tools that fuse open source and proprietary information.  The intelligence derived from these tools and techniques serve as the foundation of Wapack Labs’ information reporting to the cyber-security teams of its customers and industry partners located around the world.