The U.S. and China have never been the best of friends, and a leading Chinese security firm has accused the CIA for hacking China businesses and government agencies for the past 11 years.
In the report, Qihoo 360 claims that the U.S. intelligence agency has targeted several industries including aviation organizations, scientific research institutions, petroleum firms, internet companies, and government agencies. The spying took place between September 2008 and June 2019, and were mostly targeting those in Beijing, Guangdong, and Zhejiang.
The research links the attacks to former CIA employee Joshua Adam Schulte.
Schulte allegedly fed Wikileaks a cache, or more commonly referred to as 'Vault 7'. The collection of documentation files details CIA's arsenal of cyber-weapons, has information that can be traced back to the the CIA-associated group codenamed APT-C-39.
“We speculate that in the past eleven years of infiltration attacks, CIA may have already grasped the most classified business information of China, even of many other countries in the world,” the report reads. “It does not even rule out the possibility that now CIA is able to track down the real-time global flight status, passenger information, trade freight, and other related information.”
The security firm claims that the APT-C-39 group used some hacking techniques similar to what have been used by the NSA.
The group was also caught using spying tools exclusively developed by the CIA, like the Fluxwire and Grasshopper malware. Both malware were discovered in early 2017, just when Wikileaks published the Vault 7 dump,
Qihoo 360 claimed that CIA's hacking efforts were mostly focused on the civil aviation industry, both in China and in other countries.
The Chinese security firm suggested that the purpose of this campaign, was for a "long-term and targeted intelligence-gathering" to track "real-time global flight status, passenger information, trade freight, and other related information."
Furthermore, Qihoo 360 researchers also found that the malware's compilation times are consistent with U.S. timezones.
"Qihoo 360 analysis found that the technical details of most of the samples are consistent with the ones in the Vault 7 document, such as control commands, compile PDB paths, encryption schemes," the Chinese researchers said, in line with the findings by the Symantec report.
Since 2014, Qihoo 360's Advanced Threat Intelligence Center has achieved rapid reversing and correlation analysis by integrating massive security big data.
Having discovered more than 40 APT hacking groups and a number of other operations that work against China, the researchers found that the earliest attack can be dated back to 2007 which compromised devices distributed in 31 provinces.
APT attacks discovered by Qihoo 360 and national states security vendors both prove that China is one of the main victims of APT attacks.
With this report, Qihoo 360 becomes the second Chinese security vendor to publicly blame the U.S. for hacks inside China in the past six months.
Previously, it was in September 2019 that the cyber-security firm Qi An Xin also published a similar report blaming the CIA for hacks against Chinese aviation between 2012 and 2017.
Shortly after the report went public, some China-based news agencies that are backed by the government started to call for "swift action" against the U.S., including the CIA.
