Chinese Military Personnel Charged with Computer Fraud, Economic Espionage and Wire Fraud for Hacking into Credit Reporting Agency Equifax

A federal grand jury in Atlanta returned an indictment last week charging four members of the Chinese People’s Liberation Army (PLA) with hacking into the computer systems of the credit reporting agency Equifax and stealing Americans’ personal data and Equifax’s valuable trade secrets.


Indictment Alleges Four Members of China’s People’s Liberation Army Engaged in a Three-Month Long Campaign to Steal Sensitive Personal Information of Nearly 150 Million Americans

A federal grand jury in Atlanta returned an indictment last week charging four members of the Chinese People’s Liberation Army (PLA) with hacking into the computer systems of the credit reporting agency Equifax and stealing Americans’ personal data and Equifax’s valuable trade secrets.

The nine-count indictment alleges that Wu Zhiyong (吴志勇), Wang Qian (王乾), Xu Ke (许可) and Liu Lei (刘磊) were members of the PLA’s 54th Research Institute, a component of the Chinese military.  They allegedly conspired with each other to hack into Equifax’s computer networks, maintain unauthorized access to those computers, and steal sensitive, personally identifiable information of approximately 145 million American victims.

“This was a deliberate and sweeping intrusion into the private information of the American people,” said Attorney General William P. Barr, who made the announcement. “Today, we hold PLA hackers accountable for their criminal actions, and we remind the Chinese government that we have the capability to remove the Internet’s cloak of anonymity and find the hackers that nation repeatedly deploys against us. Unfortunately, the Equifax hack fits a disturbing and unacceptable pattern of state-sponsored computer intrusions and thefts by China and its citizens that have targeted personally identifiable information, trade secrets, and other confidential information.”

According to the indictment, the defendants exploited a vulnerability in the Apache Struts Web Framework software used by Equifax’s online dispute portal.  

They used this access to conduct reconnaissance of Equifax’s online dispute portal and to obtain login credentials that could be used to further navigate Equifax’s network.  

The defendants spent several weeks running queries to identify Equifax’s database structure and searching for sensitive, personally identifiable information within Equifax’s system.  Once they accessed files of interest, the conspirators then stored the stolen information in temporary output files, compressed and divided the files, and ultimately were able to download and exfiltrate the data from Equifax’s network to computers outside the United States. In total, the attackers ran approximately 9,000 queries on Equifax’s system, obtaining names, birth dates and social security numbers for nearly half of all American citizens.

The indictment also charges the defendants with stealing trade secret information, namely Equifax’s data compilations and database designs.  “In short, this was an organized and remarkably brazen criminal heist of sensitive information of nearly half of all Americans, as well as the hard work and intellectual property of an American company, by a unit of the Chinese military,” said Barr.

The defendants took steps to evade detection throughout the intrusion, as alleged in the indictment.  They routed traffic through approximately 34 servers located in nearly 20 countries to obfuscate their true location, used encrypted communication channels within Equifax’s network to blend in with normal network activity, and deleted compressed files and wiped log files on a daily basis in an effort to eliminate records of their activity.

“Today’s announcement of these indictments further highlights our commitment to imposing consequences on cybercriminals no matter who they are, where they are, or what country’s uniform they wear,” said FBI Deputy Director David Bowdich.  “The size and scope of this investigation — affecting nearly half of the U.S. population, demonstrates the importance of the FBI’s mission and our enduring partnerships with the Justice Department and the U.S. Attorney’s Office.  This is not the end of our investigation; to all who seek to disrupt the safety, security and confidence of the global citizenry in this digitally connected world, this is a day of reckoning.”

The defendants are charged with three counts of conspiracy to commit computer fraud, conspiracy to commit economic espionage, and conspiracy to commit wire fraud.  The defendants are also charged with two counts of unauthorized access and intentional damage to a protected computer, one count of economic espionage, and three counts of wire fraud. 

The investigation was conducted jointly by the U.S. Attorney’s Office for the Northern District of Georgia, the Criminal and National Security Divisions of the Department of Justice, and the FBI’s Atlanta Field Office.  The FBI’s Cyber Division also provided support.  Equifax cooperated fully and provided valuable assistance in the investigation.

Assistant U.S. Attorneys Nathan Kitchens, Samir Kaushal, and Thomas Krepp of the Northern District of Georgia; Senior Counsel Benjamin Fitzpatrick of the Criminal Division’s Computer Crime and Intellectual Property Section; and Trial Attorney Scott McCulloch of the National Security Division’s Counterintelligence and Export Control Section are prosecuting this case.  Attorneys with the Office of International Affairs provided critical assistance in obtaining evidence from overseas.  

The details contained in the charging document are allegations.  The defendants are presumed innocent until proven guilty beyond a reasonable doubt in a court of law.

Justice.gov (February, 2020) Chinese Military Personnel Charged with Computer Fraud, Economic Espionage and Wire Fraud for Hacking into Credit Reporting Agency Equifax

Confronting the China Threat

China is threatening the U.S. economy—and national security—with its relentless efforts to steal sensitive technology and proprietary information from U.S. companies, academic institutions, and other organizations, FBI Director Christopher Wray said


Director Wray Says Whole-of-Society Response is Needed to Protect U.S. Economic and National Security

China is threatening the U.S. economy—and national security—with its relentless efforts to steal sensitive technology and proprietary information from U.S. companies, academic institutions, and other organizations, FBI Director Christopher Wray said on Thursday.

Wray described the threat from China as “diverse” and “multi-layered.” He noted that the Chinese government exploits the openness of the American economy and society.

“They’ve pioneered an expansive approach to stealing innovation through a wide range of actors,” Wray said during opening remarks at the half-day Department of Justice China Initiative Conference in Washington, D.C.

Wray told the audience that China is targeting everything from agricultural techniques to medical devices in its efforts to get ahead economically. While this is sometimes done legally, such as through company acquisitions, China often takes illegal approaches, including cyber intrusions and corporate espionage.

“They’ve shown that they’re willing to steal their way up the economic ladder at our expense,” he said.

Soffe Men’s 3 Pack-USA Poly Cotton Military Tee

The FBI is using traditional law enforcement techniques as well as its intelligence capabilities to combat these threats. He said the FBI currently has about 1,000 investigations into Chinese technology theft.

Just last month, a Harvard University professor was charged with lying about his contractual arrangement with China.

Wray also called for a whole-of-society response to these threats. He urged U.S. companies to carefully consider their supply lines and whether and how they do business with Chinese companies. While a partnership with a Chinese company may seem profitable today, a U.S. company may find themselves losing their intellectual property in the long run.

Additionally, U.S. universities should work to protect their foreign students from coercion from foreign governments, Wray said.

Wray noted, however, that these threats do not mean the U.S. shouldn’t welcome Chinese students or visitors.

“What it does mean is that when China violates our criminal laws and well-established international norms, we are not going to tolerate it, much less enable it,” he said. “The Department of Justice and the FBI are going to hold people accountable for that and protect our nation’s innovation and ideas.”

FBI.gov (February, 2020) Confronting the China Threat

BBB Warns About Cell Phone Porting Scams

The Better Business Bureau first warned consumers of cell phone porting scams two years ago, but it appears the problem is getting worse.


Did you know that with a few easy steps someone could steal your phone number and phone service? 

The Better Business Bureau first warned consumers of cell phone porting scams two years ago, but it appears the problem is getting worse.

According to a CBC article, a farm family in Sasketchewan lost hundreds of thousands of dollars when a cell phone was stolen and their business bank account was emptied. This scam is another way for scammers to steal your hard earned money, and even your identity.

The scariest part is that this type of scam, called porting or port-out scamming, is that it can help scammers get past added security measures on personal and financial accounts and logins.

To put it another way, think of how many times you have set up an email address, social networking, or logged onto your bank account online or had to change your password. How many times did you have to verify your identity by being sent a code via text message? Now what if you weren’t the only one who was reading that message? This new type of scam absolutely could bypass that layer of security and has a huge potential for your identity to be stolen faster than you think.

Luckily you can protect yourself and your Better Business Bureau® is here to help you identify and protect yourself.

What is a cell phone porting or port-out scam?

A scammer finds out your name and phone number and then attempts to gather as much personal identifiable information (PII) as possible about you. PII includes name, address, Social Security number (Social Insurance number in Canada), date of birth, and other information that can be used for identity theft.  They then will contact your mobile provider, impersonating you, and inform them that your phone was stolen and request the number be “ported” with another provider and device.  In some cases, if they were really brave and in a retail location and/or online, they might even try to buy a new phone which could make a sales representative incentivized to quickly fulfill their request and forgo some formal verification procedures.  

The scariest part?  Once they have your number ported to a new device they can then start accessing and gaining entry to accounts that require additional authorization in terms of a code texted directly to your phone for security verification.  Those added security measures are usually in place on accounts provided by email providers, social networks, tax preparation software, and even financial institutions

BBB offers these tips to help protect you from this specific type of scam:

  • Inquire with your wireless provider about port-out authorization.  Every major wireless has some sort of additional security for accounts or for port-out authorization that customers can set up, like a unique pin, or add verification question, which will make it more difficult for someone to port-out your phone.  Contact your mobile provider and speak to them specifically about porting and/or port out security on your account.
  • Watch out for unexpected “Emergency Calls Only” status.  Call your mobile phone company if your phone suddenly switches to “emergency call service only” or something similar. That’s what happens when your phone number has been transferred to another phone.  
  • Be vigilant in about communications you receive.  Watch out for phishing attempts, alert messages from financial institutions, texts in response to two-factor authorization requests.

For more tips on how to protect your personal information and guard yourself against identity theft click here.

If you’ve fallen victim to this type of scam, alert your mobile provider, financial institutions and take the standard steps to combat identity theft.

Also, BBB encourages you to file a report on BBB ScamTracker and be a hero to your community by warning others.

BBB.org (February, 2020) BBB Warns About Cell Phone Porting Scams

 Help me maintain this news reporting blog by donating here.

Fake Investors Busted in Belgium and France

The French National Gendarmerie (Gendarmerie Nationale) in collaboration with the Belgian Federal Judicial Police (Police Judiciaire Fédérale) and the Israeli Police, supported by Europol and Eurojust, have brought down a large network of investment fraudsters


More than 85 victims in Belgium and France suffered around €6 million losses for believing in the fraudsters’ false promises

The French National Gendarmerie (Gendarmerie Nationale) in collaboration with the Belgian Federal Judicial Police (Police Judiciaire Fédérale) and the Israeli Police, supported by Europol and Eurojust, have brought down a large network of investment fraudsters.

The criminal group was involved in money laundering and binary investment fraud

In the beginning of 2019, four suspects were arrested in France, three of which were detained. At the end of 2019, five other suspects were arrested and questioned in Israel with the support of an international Operational Task Force set-up by Europol bringing together Belgian, French, and Israeli investigators and magistrates.

More than one million euros ($1.1 million US dollars) have already been seized from the fraudsters’ accounts.

A French-Israeli citizen who has already been convinced of massif fraud related to carbon tax is suspected to be the mastermind.

FAKE WEBSITES AND BOGUS COMPANIES TO FRAUD INVESTORS

The investigation into this criminal network, active in Belgium and France and controlled by an Israeli branch, began in 2018. The criminal organization managed to set-up a sophisticated system promising big gains on investments in bitcoin, gold and diamonds. The suspects were offering their financial services on online platforms. The criminal network also set up bogus companies as a part of their money laundering scheme.  

The suspects were promising between 5 and 35% return on investment. They then proceeded to pretend to manage the victims’ wallets and invite them to invest more money. To increase the confidence in their services, they were paying some of the victims the interests on their investments. Once the victims were won over, the fraudsters would offer bigger opportunities, which required higher amounts to be invested.

A big French private company and a French local authority are among the victims of this network. The investments of the victims were placed on accounts in different EU Member States before being transferred to other international accounts. 

The network is believed to be responsible for frauds which amount to at least €6 million ($6.6 Million US Dollars). The investigators have also discovered invoices for few million euros, which the fraudsters had not yet finalized.

Europol supported the investigation since 2018 and facilitated the information exchange between the participating countries. A Europol Operation Task Force between investigators and magistrates from Belgium, France and Israel to increase the operational cooperation between the countries involved in the investigation.

Europol provided also analytical and technical support and deployed an expert on-the-spot to cross-check operational information against Europol’s databases and thus, provide leads to investigators. 

Help me maintain this news reporting blog by donating here.

Malware stealing payment card details identified with support of private partner

An INTERPOL-coordinated cyber operation against a strain of malware targeting e-commerce websites has identified hundreds of compromised websites and led to the arrest of three individuals running the malicious campaign in Indonesia.


An INTERPOL-coordinated cyber operation against a strain of malware targeting e-commerce websites has identified hundreds of compromised websites and led to the arrest of three individuals running the malicious campaign in Indonesia.

The malware, known as a JavaScript-sniffer, targets online shopping websites.

When a website is infected, the malware steals the customers’ payment card details and personal data such as names, addresses and phone numbers, sending the information to Command and Control (C2) servers controlled by the cyber-criminals.

Data provided to INTERPOL through a partnership with cybersecurity firm Group-IB on the scope and range of this malware helped identify hundreds of infected e-commerce websites worldwide. Group-IB also supported the investigation with digital forensics expertise helping to identify the suspects.

Under Operation Night Fury, INTERPOL’s ASEAN Cyber Capability Desk disseminated Cyber Activity Reports to the affected countries, highlighting the threat to support their national investigations. In particular, the intelligence detected C2 servers and infected websites located in six countries in the Association of Southeast Asian Nations (ASEAN) region.

At the request of the Indonesian National Police, the ASEAN Desk provided technical and operational support that resulted in the arrest of three individuals suspected of commanding the C2 servers in the country.

The investigation revealed the suspects were using the stolen payment card details to purchase electronic good and other luxury items, and then reselling them for a profit.

“Strong and effective partnerships between police and the cybersecurity industry are essential to ensure law enforcement worldwide has access to the information they need to address the scale and complexity of today’s cyber threat landscape,” said Craig Jones, INTERPOL’s Director of Cyber-crime.

“This successful operation is just one example of how law enforcement is working with industry partners, adapting and applying new technologies to aid investigations, and ultimately reduce the global impact of cyber-crime,” Jones said.

In Singapore, authorities identified and took down two of the C2 servers. Investigations in other ASEAN countries are ongoing, with INTERPOL continuing to support police in locating C2 servers and infected websites and identifying the cyber-criminals involved.

Interpol.int. (2020). INTERPOL supports arrest of cybercriminals targeting online shopping websites. [Accessed 28 Jan. 2020].

Help me maintain this blog by donating here.