Feds Charge Chinese Hackers With Ripping Off Video Game Loot From 9 Companies

For years, a group of Chinese hackers known variously as Barium, Winnti, or APT41 has carried out a unique mix of sophisticated hacking activities that has puzzled the cybersecurity researchers tracking them. At times they appear focused on the usual state-sponsored espionage, believed to be working in the service of the Chinese Ministry of State Security. At other times their attacks looked more like traditional cybercrime. Now a set of federal indictments has called out those intruders by name, and cast their activities in a new light.

Five Chinese hackers are accused of a sprawling scheme to break into the networks of hundreds of global companies in a broad range of industries, as well as think tanks, universities, foreign government agencies, and the accounts of Hong Kong government officials and pro-democracy activists. The victims are located in a dozen Asian countries as well as the US, France, Australia, the United Kingdom, and Chile. The Department of Justice says that the hackers, employed by a company called Chengdu 404 Network Technology, allegedly hit dozens of private companies to steal millions of dollars, sometimes using ransomware schemes or cryptojacking, malware that exploits compromised computers to generate cryptocurrency. In many cases, the hackers used a rare and brazen technique known as supply chain attacks to plant their malicious code in legitimate software used by their targets.

But the most detailed element of the alleged schemes revealed in the indictments is the targeting of nine video game firms. The victims go unnamed, but are based in the US, France, South Korea, Japan, and Singapore. Court documents describe how the attackers used supply chain attacks and spear-phishing to infiltrate those companies' networks. They used that access to generate in-game goods and artificially inflate the virtual currency balances of accounts controlled by two Malaysian men, Wong Ong Hua and Ling Yang Chua, who would then allegedly sell the hacker-created items and currency on a market they controlled called SEA Gamer. The DOJ says it's currently seeking the extradition of both men.