Chinese state-sponsored hackers compromised more than a million internet devices worldwide to steal sensitive personal data
The FBI has disrupted a botnet controlled by Chinese state-sponsored hackers that infected over 1.2 million devices worldwide, including over 385,000 in the US.
The botnet, utilising a variant of the Mirai malware, targeted consumer devices like routers, cameras, and storage devices to steal personal information and potentially conduct cyberattacks.
The hackers, identified as Integrity Technology Group, are a publicly traded company in China that sold access to the botnet to customers.
Biometric Update reported on Friday that a Chinese state-sponsored hacking group, known as Flax Typhoon, compromised hundreds of thousands of consumer devices worldwide, including routers, webcams, CCTV cameras and other internet-connected devices. The operation, disrupted by the US Federal Bureau of Investigation (“FBI”) and other international partners, was carried out by Integrity Technology Group, a Beijing-based company.
The compromised devices were used to create a massive botnet, allowing Chinese hackers to remotely access and control them. This enabled the hackers to infect devices with malware, steal sensitive personal and other data, and use compromised devices to conduct distributed denial-of-service (“DDoS”) attacks and spread malware.
The devices “undoubtedly were used” by the Chinese government to attempt to obtain not only the personally identifiable information (“PII”) of anyone using these devices, but also financial, legal and business information, the latter of which could include confidential and proprietary information, counterintelligence officials told Biometric Update.
At the Aspen Cyber Summit cybersecurity conference this week, FBI Director Christopher Wray said the hacking group called Flax Typhoon, was “targeting critical infrastructure across the US and overseas, everyone from corporations and media organisations to universities and government agencies.”
Further reading:
- FBI Director warns, China lined hackers breaking into routers and IoT devices to run botnets, Times of India, 19 September 2024
- Press Release: Court-Authorised Operation Disrupts Worldwide Botnet Used by People’s Republic of China State-Sponsored Hackers, Office of Public Affairs US Department of Justice, 18 September 2024
The affected devices were located globally, with no specific country or region being spared. The FBI’s investigation revealed that the Chinese government contractor, Integrity Technology Group, openly sold its customers the ability to hack into and control thousands of consumer devices worldwide.
The FBI and international partners have disrupted the operation, issuing a joint cybersecurity advisory on Wednesday about the hacker’s tactics, techniques and procedures. However, counterintelligence officials expressed concerns about what sensitive personal and other data was able to be obtained or otherwise compromised before the FBI managed to shut down the operation.
