27 Chinese Hackers Profiled

Hacker use information sharing and collaboration, and there is a large community of Chinese coders are doing just that -- exchanging ideas, and tools, and sharing software development. This week, Wapack Labs published a study of 27 of the most active Chinese coders, revealing the some common characteristics of this community:

• These coders are not lone hackers. They are mostly employed in major corporations or network security entities. This includes Alibaba, TenCent, and Huawei, and security entities KnownSec, Keen Team, and Evil Octal.
• They are not anonymous. Real names were found for 18 of the 27 coders studied.
• Many are well known in China and abroad. Several of those studied had more than 400 followers, and one had about 1,800.
• Many are contributing regularly; Several updating ideas and code more than 200 times over a year period.

In addition, the white-hat posture taken by these coders appears to have been accepted so far by the Chinese government. This community does not appear to fear suppression by the government, similar to the shutdown of the Wooyun vulnerability-hunter website earlier this year.

Publication Date: 8 December 2016

Handling Requirements: Traffic light protocol (TLP) AMBER
Attribution/Threat Actors: Criminal or state actors who are organized, highly technical, proficient, well-funded professionals working in teams to discover new vulnerabilities and develop exploits.

Actor Type: Adversary capabilities have been assessed as Tier IV

Industries Targeted: Multi-industry targets/International

Past Reporting: The full reports may be viewed in Red Sky Alliance as DOC-2098, DOC-4350, and comment-7187.  Contact Wapack Labs for more information.  

Wooyun Chinese Vulnerability Reporting Platform Shut Down

 

Wooyun, the website for China’s largest vulnerability hunting and reporting community, was shut down in July 2016, and its founder Fang Xiaodun and other website personnel were reportedly arrested.  The immediate cause seems to be a complaint from a corporate target whose data was “stolen” by a vulnerability hunter who reported the vulnerability through Wooyun. Other Chinese reporting indicates that Chinese corporations had become frustrated with white-hat hackers for exposing their system vulnerabilities, and the Wooyun community became a focus of this frustration. The arrests indicate a shift in government attitude, perhaps because of corporate pressure, and vulnerability hunting may be entering a period of pushback from both government and the Chinese business community.

Publication date:                         23 Sep 2016

Handling requirements:               Traffic light protocol (TLP) AMBER.

Attribution/Threat Actors:           Chinese State Actor

Actor Type:                                  Adversary capabilities have been assessed as Tier IV.*

Previous Reporting:                      None

Industries Targeted:                     Chinese Information Security

*Criminal or state actors who are organized, highly technical, proficient, well-funded professionals working in teams to discover new vulnerabilities and develop exploits.

The full attribution report has been published in its entirety in the Red Sky Alliance portal.  For more information please contact the lab directly at 844-4-WAPACK, 603-606-1246, or feedback@wapacklabs.com.

About Wapack Labs

Wapack Labs, located in New Boston, NH is a Cyber Threat Analysis and Intelligence organization supporting the Red Sky Alliance, the FS-ISAC and individual organizations by offering expert level targeted intelligence analysis answering some of the hardest questions in Cyber.  Wapack Labs’ engineers, researchers and analysts use deep analysis techniques and visualization to design and deliver transformational cyber-security analysis tools that fuse open source and proprietary information.  The intelligence derived from these tools and techniques serve as the foundation of Wapack Labs’ information reporting to the cyber-security teams of its customers and industry partners located around the world.