Orgs targeted by PRC spies since 2021: US dismantles global hacking infrastructure used for data theft

United States authorities have successfully disrupted Chinese hacking tools used to steal sensitive data from targets worldwide, according to The Register. Seven governments issued coordinated warnings regarding the persistent threat posed by People's Republic of China spies. This international alert highlights the scale of the data theft operation that compromised devices across multiple regions before law enforcement intervened.

The coordinated action marks a significant disruption to a long-running espionage campaign. The Register reports that the FBI stepped in to halt the operations. This intervention stopped the ongoing infection of devices that had been targeted since 2021. The disruption prevents further unauthorized access to sensitive information held by organizations and individuals in the affected jurisdictions.

How it unfolded

• Chinese state-sponsored actors began infecting devices with hacking tools in 2021.
• The espionage campaign continued globally, stealing sensitive data from various targets.
• The FBI intervened to disrupt the tools and halt the ongoing theft.

Who is affected

Organizations and individuals whose devices were infected between 2021 and the FBI intervention are affected. The Register notes that the theft involved sensitive data stolen worldwide. Seven specific governments issued warnings, indicating that the scope of the compromise spans multiple national borders. Managed service providers should review their client environments for any signs of this historical compromise, as the data theft may have impacted critical infrastructure or corporate networks.

Our take on the response

The disruption by US authorities demonstrates the effectiveness of cross-border law enforcement cooperation. By dismantling the tools, the FBI has stopped the immediate flow of stolen data. However, the fact that devices were infected from 2021 suggests a significant window of exposure. Organizations must assume that data exfiltrated during this period is compromised. The coordinated warning from seven governments underscores the severity of the threat and the need for continued vigilance against state-sponsored actors.

What to do and how to stay safe: FBI

• Review network logs for any unusual outbound traffic or connections to known malicious IPs associated with Chinese state-sponsored groups.
• Audit access controls on sensitive data repositories to ensure that only authorized personnel have access and that permissions are strictly enforced.
• Monitor for indicators of compromise related to the specific hacking tools disrupted by the FBI, such as unusual process executions or file modifications.
• Conduct a thorough inventory of all devices connected to the network since 2021 to identify any potential endpoints that may have been infected.

Step-by-step guide: Social Engineering Tactics: How Attackers Bypass Technical Defenses

General security guidance from the Patch Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

When did this hacking campaign begin?

The campaign began in 2021, with devices being infected continuously until the FBI intervened.

Which countries were involved in the warning?

Seven governments issued warnings, though the specific nations are not named in this report.

Has the data theft stopped?

Yes, the FBI stepped in to disrupt the tools, halting the ongoing theft of sensitive data.