China-linked cybercriminals targeted Russia

Although China and Russia appear on the surface as two allies who support each other politically and militarily, this cooperation is rapidly deteriorating in the cyber world. According to recent news, China-linked cybercriminals have carried out attacks targeting Russia’s government devices and IT providers. Analysis by Kaspersky revealed that APT27 and APT31, two China-based threat groups, were behind these attacks.

Why did China-linked cyber attacks target Russia?

Kaspersky researchers discovered a cyberattack campaign dubbed “EastWind” in Russia starting in late July. In these attacks, malware developed by Chinese-linked APT27 and APT31 groups was detected. Attackers managed to infiltrate the devices of the Russian government and IT providers through phishing emails. Malicious files added to emails communicated with platforms such as DropBox, GitHub and Quora, downloading and executing second-stage malware.

The malware used in these attacks includes a trojan called GrewApacha and a backdoor called CloudSorcerer. CloudSorcerer has also previously been used in attacks against organizations in the US and was used to download a new implant called PlugY, which offers functions such as file manipulation, command execution, keyboard recording, and more.

Although China and Russia are known as two countries that support each other at the political and military level, this cooperation in the cyber field seems fragile. According to Kaspersky’s report, cybercrime groups supported by the Chinese state are collaborating in information gathering and attack strategies.

While China supports Russia’s invasion of Ukraine, Russia also supports China’s international stances such as the “One China” policy. However, when it comes to information wars, alliances can break down even between these two powerful allies.

You see, cybersecurity is becoming increasingly critical in the international arena. How do you think this tension between China and Russia will be shaped in the future of cyber wars?