China-linked hacker group has gone quiet, but DHS expects resurgence
An advanced persistent threat group linked to the Chinese government accused of conducting a widespread cyber espionage campaign against IT service providers has gone quiet since two of its members were indicted by the Department of Justice last year, according to a Department of Homeland Security official, but it remains an active threat to American businesses.
The group, known as APT 10, has a history of targeting the U.S. technology supply chain. In recent years, it has begun focusing attention on compromising managed service and cloud providers who often remotely manage IT systems and store data on behalf of client companies and -- when compromised -- can offer hackers wider access to the networks of multiple businesses.
Rex Booth, chief of cyber threat analysis at the Cybersecurity and Infrastructure Security Agency, said at a DHS webinar held Feb. 6, the campaign against IT service providers started in 2014 and continued through 2018. The campaign is part of a larger strategic shift by APT10 in recent years from "labor intensive, one-off compromises of individual targets" to "force multiplier effects that enable them to compromise multiple targets through a single attack."
