APT17 Outed as MSS Operation

A group of anonymous researchers have outed the APT17 cyber-attack group (aka DeputyDog) as a Chinese Ministry of State Security (MSS) operation, potentially paving the way for more US indictments.

Intrusion Truth have been right before, when they identified APT3 and APT10 as MSS groups: the former operated by a contractor known as Boyusec. These revelations led to Department of Justice indictments against some of the groups’ members in 2017 and 2018.

Now Intrusion Truth has identified a likely MSS officer, Guo Lin, who studied information security to Masters level and is affiliated with four private technology companies in the eastern city of Jinan. The group also identified two hackers from Jinan – Wang Qingwei, who works at one of those four tech firms, and Zeng Xiaoyong (aka “envymask”). Zeng is said to have submitted code used in a popular Chinese APT hacking tool known as ZoxRPC, which was subsequently developed into a newer tool, ZoxPNG (aka BLACKCOFFEE) by another Jinan hacker, Zhang Peng. ZoxPNG became a key part of multiple APT17 hacking campaigns, the blog post continued.