{"id":99318,"date":"2023-09-12T14:25:24","date_gmt":"2023-09-12T14:25:24","guid":{"rendered":"https:\/\/www.ghanamma.com\/2023\/09\/12\/china-linked-hackers-breached-a-power-grid-again\/"},"modified":"2023-09-12T14:25:24","modified_gmt":"2023-09-12T14:25:24","slug":"china-linked-hackers-breached-a-power-grid-again","status":"publish","type":"post","link":"https:\/\/www.ghanamma.com\/2023\/09\/12\/china-linked-hackers-breached-a-power-grid-again\/","title":{"rendered":"China-Linked Hackers Breached a Power Grid\u2014Again"},"content":{"rendered":"<p><\/p>\n<div>\n<p class=\"paywall\">Some evidence suggests the 2021 India-focused hacking campaign and the new power grid breach identified by Symantec were both carried out by the same team of hackers with links to the broad umbrella group of Chinese state-sponsored spies known as APT41, which is sometimes called Wicked Panda or Barium. Symantec notes that the hackers whose grid-hacking intrusion it tracked used a piece of malware known as ShadowPad, which was deployed by an APT41 subgroup in 2017 to infect machines in a supply chain attack that corrupted code distributed by networking software firm NetSarang and in several incidents since then. In 2020, five alleged members of APT41 were indicted and identified as working for a contractor for China\u2019s Ministry of State Security known as Chengdu 404. But even just last year, the US Secret Service warned that hackers within APT41 had stolen millions in US Covid-19 relief funds, a rare instance of state-sponsored cybercrime targeting another government.<\/p>\n<p class=\"paywall\">Although Symantec didn\u2019t link the grid-hacking group it\u2019s calling RedFly to any specific subgroup of APT41, researchers at cybersecurity firm Mandiant point out that both the RedFly breach and the years-earlier Indian grid-hacking campaign used the same domain as a command-and-control server for their malware: Websencl.com. That suggests the RedFly group may in fact be tied to both cases of grid hacking, says John Hultquist, who leads threat intelligence at Mandiant. (Given that Symantec wouldn\u2019t name the Asian country whose grid RedFly targeted, Hultquist adds that it may in fact be India again.)<\/p>\n<p class=\"paywall\">More broadly, Hultquist sees the RedFly breach as a troubling sign that China is shifting its focus toward more aggressive targeting of critical infrastructure like power grids. For years, China largely focused its state-sponsored hacking on espionage, even as other nations like Russia and Iran have attempted to breach electrical utilities in apparent attempts to plant malware capable of triggering tactical blackouts. The Russian military intelligence group Sandworm, for example, has attempted to cause three blackouts in Ukraine\u2014two of which succeeded. Another Russian group tied to its FSB intelligence agency known as Berserk Bear has repeatedly breached the US power grid to gain a similar capability, but without ever attempting to cause a disruption.<\/p>\n<p class=\"paywall\">Given this most recent Chinese grid breach, Hultquist argues it\u2019s now beginning to appear that some Chinese hacker teams may have a similar mission to that Berserk Bear group: to maintain access, plant the malware necessary for sabotage, and wait for the order to deliver the payload of that cyberattack at a strategic moment. And that mission means the hackers Symantec caught inside the unnamed Asian country\u2019s grid will almost certainly return, he says.<\/p>\n<p class=\"paywall\">\u201cThey have to maintain access, which means they\u2019re probably going to go right back in there. They get caught, they retool, and they show up again,\u201d says Hultquist. \u201cThe major factor here is their ability to just stay on target\u2014until it\u2019s time to pull the trigger.\u201d<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>Some evidence suggests the 2021 India-focused hacking campaign and the new power grid breach identified by Symantec were both carried out by the same team of hackers with links to the broad umbrella group of Chinese state-sponsored spies known as APT41, which is sometimes called Wicked Panda or Barium. Symantec notes that the hackers whose [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[21],"tags":[],"class_list":["post-99318","post","type-post","status-publish","format-standard","category-technology"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v24.2 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>China-Linked Hackers Breached a Power Grid\u2014Again - Ghanamma.com<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.ghanamma.com\/2023\/09\/12\/china-linked-hackers-breached-a-power-grid-again\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"China-Linked Hackers Breached a Power Grid\u2014Again - Ghanamma.com\" \/>\n<meta property=\"og:description\" content=\"Some evidence suggests the 2021 India-focused hacking campaign and the new power grid breach identified by Symantec were both carried out by the same team of hackers with links to the broad umbrella group of Chinese state-sponsored spies known as APT41, which is sometimes called Wicked Panda or Barium. Symantec notes that the hackers whose [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.ghanamma.com\/2023\/09\/12\/china-linked-hackers-breached-a-power-grid-again\/\" \/>\n<meta property=\"og:site_name\" content=\"Ghanamma.com\" \/>\n<meta property=\"article:published_time\" content=\"2023-09-12T14:25:24+00:00\" \/>\n<meta name=\"author\" content=\"Ghana News\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Ghana News\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.ghanamma.com\/2023\/09\/12\/china-linked-hackers-breached-a-power-grid-again\/\",\"url\":\"https:\/\/www.ghanamma.com\/2023\/09\/12\/china-linked-hackers-breached-a-power-grid-again\/\",\"name\":\"China-Linked Hackers Breached a Power Grid\u2014Again - Ghanamma.com\",\"isPartOf\":{\"@id\":\"https:\/\/www.ghanamma.com\/2023\/#website\"},\"datePublished\":\"2023-09-12T14:25:24+00:00\",\"dateModified\":\"2023-09-12T14:25:24+00:00\",\"author\":{\"@id\":\"https:\/\/www.ghanamma.com\/2023\/#\/schema\/person\/6f91dab2e50bbbfe895c93e7e84e7f74\"},\"breadcrumb\":{\"@id\":\"https:\/\/www.ghanamma.com\/2023\/09\/12\/china-linked-hackers-breached-a-power-grid-again\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.ghanamma.com\/2023\/09\/12\/china-linked-hackers-breached-a-power-grid-again\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.ghanamma.com\/2023\/09\/12\/china-linked-hackers-breached-a-power-grid-again\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.ghanamma.com\/2023\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"China-Linked Hackers Breached a Power Grid\u2014Again\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.ghanamma.com\/2023\/#website\",\"url\":\"https:\/\/www.ghanamma.com\/2023\/\",\"name\":\"Ghanamma.com\",\"description\":\"Ghana mma provides breaking news, top stories in Ghana, Africa, business, entertainment, politics and more.\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.ghanamma.com\/2023\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.ghanamma.com\/2023\/#\/schema\/person\/6f91dab2e50bbbfe895c93e7e84e7f74\",\"name\":\"Ghana News\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.ghanamma.com\/2023\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/22cb97c2b08df229330efb2b8c2645feaae8d3ca3ee434035fbb668b5b82f570?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/22cb97c2b08df229330efb2b8c2645feaae8d3ca3ee434035fbb668b5b82f570?s=96&d=mm&r=g\",\"caption\":\"Ghana News\"},\"sameAs\":[\"https:\/\/www.ghanamma.com\/2023\"],\"url\":\"https:\/\/www.ghanamma.com\/2023\/author\/ghanamma\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"China-Linked Hackers Breached a Power Grid\u2014Again - Ghanamma.com","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.ghanamma.com\/2023\/09\/12\/china-linked-hackers-breached-a-power-grid-again\/","og_locale":"en_US","og_type":"article","og_title":"China-Linked Hackers Breached a Power Grid\u2014Again - Ghanamma.com","og_description":"Some evidence suggests the 2021 India-focused hacking campaign and the new power grid breach identified by Symantec were both carried out by the same team of hackers with links to the broad umbrella group of Chinese state-sponsored spies known as APT41, which is sometimes called Wicked Panda or Barium. Symantec notes that the hackers whose [&hellip;]","og_url":"https:\/\/www.ghanamma.com\/2023\/09\/12\/china-linked-hackers-breached-a-power-grid-again\/","og_site_name":"Ghanamma.com","article_published_time":"2023-09-12T14:25:24+00:00","author":"Ghana News","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Ghana News","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.ghanamma.com\/2023\/09\/12\/china-linked-hackers-breached-a-power-grid-again\/","url":"https:\/\/www.ghanamma.com\/2023\/09\/12\/china-linked-hackers-breached-a-power-grid-again\/","name":"China-Linked Hackers Breached a Power Grid\u2014Again - Ghanamma.com","isPartOf":{"@id":"https:\/\/www.ghanamma.com\/2023\/#website"},"datePublished":"2023-09-12T14:25:24+00:00","dateModified":"2023-09-12T14:25:24+00:00","author":{"@id":"https:\/\/www.ghanamma.com\/2023\/#\/schema\/person\/6f91dab2e50bbbfe895c93e7e84e7f74"},"breadcrumb":{"@id":"https:\/\/www.ghanamma.com\/2023\/09\/12\/china-linked-hackers-breached-a-power-grid-again\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.ghanamma.com\/2023\/09\/12\/china-linked-hackers-breached-a-power-grid-again\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.ghanamma.com\/2023\/09\/12\/china-linked-hackers-breached-a-power-grid-again\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.ghanamma.com\/2023\/"},{"@type":"ListItem","position":2,"name":"China-Linked Hackers Breached a Power Grid\u2014Again"}]},{"@type":"WebSite","@id":"https:\/\/www.ghanamma.com\/2023\/#website","url":"https:\/\/www.ghanamma.com\/2023\/","name":"Ghanamma.com","description":"Ghana mma provides breaking news, top stories in Ghana, Africa, business, entertainment, politics and more.","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.ghanamma.com\/2023\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/www.ghanamma.com\/2023\/#\/schema\/person\/6f91dab2e50bbbfe895c93e7e84e7f74","name":"Ghana News","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.ghanamma.com\/2023\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/22cb97c2b08df229330efb2b8c2645feaae8d3ca3ee434035fbb668b5b82f570?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/22cb97c2b08df229330efb2b8c2645feaae8d3ca3ee434035fbb668b5b82f570?s=96&d=mm&r=g","caption":"Ghana News"},"sameAs":["https:\/\/www.ghanamma.com\/2023"],"url":"https:\/\/www.ghanamma.com\/2023\/author\/ghanamma\/"}]}},"_links":{"self":[{"href":"https:\/\/www.ghanamma.com\/2023\/wp-json\/wp\/v2\/posts\/99318","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.ghanamma.com\/2023\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.ghanamma.com\/2023\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.ghanamma.com\/2023\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.ghanamma.com\/2023\/wp-json\/wp\/v2\/comments?post=99318"}],"version-history":[{"count":0,"href":"https:\/\/www.ghanamma.com\/2023\/wp-json\/wp\/v2\/posts\/99318\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.ghanamma.com\/2023\/wp-json\/wp\/v2\/media?parent=99318"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.ghanamma.com\/2023\/wp-json\/wp\/v2\/categories?post=99318"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.ghanamma.com\/2023\/wp-json\/wp\/v2\/tags?post=99318"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}