Chinese hackers cloned a Windows security flaw stolen from the NSA
The investigation into a malware tool being used by Chinese hackers has revealed it to be a copy of software reportedly originally developed by part of the US National Security Agency (NSA).
Security researchers at Check Point Research (CPR) originally thought the tool dubbed Jian was custom built by Chinese threat actors. However further CPR digging revealed that it is a clone of the EpMe software, which was used by the Equation Group, which has long been suspected to operate on the behest of the NSA.
According to ZDNet, CPR notes that "the tool is used after an attacker gains initial access to a target computer -- say, via zero-click vulnerability, phishing email, or any other option -- to give the attacker the highest available privileges, so they could "roam free" and do whatever they like on the already infected computer."
