U.S. employee data breach tied to Chinese intelligence

Before you go, we thought you'd like these...
What China's Hacking Means for National Security
The Chinese hacking group suspected of stealing sensitive information about millions of current and former U.S. government employees has a different mission and organizational structure than the military hackers who have been accused of other U.S. data breaches, according to people familiar with the matter.

While the Chinese People's Liberation Army typically goes after defense and trade secrets, this hacking group has repeatedly accessed data that could be useful to Chinese counter-intelligence and internal stability, said two people close to the U.S. investigation.

Washington has not publicly accused Beijing of orchestrating the data breach at the U.S. Department of Homeland Security's Office of Personnel Management (OPM), and Chinahas dismissed as "irresponsible and unscientific" any suggestion that it was behind the attack.

17 PHOTOS
Federal data hack, U.S. government, data breach
See Gallery
U.S. employee data breach tied to Chinese intelligence
Katherine Archuleta, director of the Office of Personnel Management, listens during a hearing of the Senate Homeland Security and Governmental Affairs Committee on Capitol Hill June 25, 2015 in Washington, DC. Witnesses testified about the hacking of Office of Personnel Management data. (Photo credit: BRENDAN SMIALOWSKI/AFP/Getty Images)
From left Katherine Archuleta, director of the Office of Personnel Management, US Chief Information Officer Tony Scott, Assistant Homeland Security Secretary for National Protection and Programs Andy Ozment, and McFarland, inspector general of the Office of Personnel Management, are sworn in during a hearing of the Senate Homeland Security and Governmental Affairs Committee on Capitol Hill June 25, 2015 in Washington, DC. Witnesses testified about the hacking of Office of Personnel Management data. AFP PHOTO/BRENDAN SMIALOWSKI (Photo credit should read BRENDAN SMIALOWSKI/AFP/Getty Images)
UNITED STATES - JUNE 23 - Katherine Archuleta, director, Office of Personnel Management, testifies during a Senate Appropriations Financial Services and General Government Subcommittee hearing to review data security and information technology spending at the Office of Personal Management on Capitol Hill on Tuesday, June 23, 2015. (Photo By Al Drago/CQ Roll Call)
WASHINGTON, DC - JUNE 23: Katherine Archuleta, director of Office of Personnel Management, arrives for a Senate Appropriations Financial Services and General Government Subcommittee hearing to review information technology spending and data security at the U.S. Office of Personnel Management, on Capitol Hill, June 23, 2015 in Washington, DC. FBI Director James Comey recently told Senators in a closed-door meeting that the personal data of an estimated 18 million current and former federal employees were affected by a recent cyber breach at the Office of Personnel Management. (Drew Angerer/Getty Images)
White House Press Secretary Josh Earnest answers questions on the massive cyber-attack on the personal data of government employees June 5, 2015 during the daily briefing in the Brady Briefing Room of the White House in Washington, DC. The US government on Thursday admitted hackers accessed the personal data of at least four million current and former federal employees, in a vast cyber-attack suspected to have originated in China. AFP PHOTO/Mandel NGAN (Photo credit should read MANDEL NGAN/AFP/Getty Images)
White House Press Secretary Josh Earnest answers questions on the massive cyber-attack on the personal data of government employees June 5, 2015 during the daily briefing in the Brady Briefing Room of the White House in Washington, DC. The US government on Thursday admitted hackers accessed the personal data of at least four million current and former federal employees, in a vast cyber-attack suspected to have originated in China. AFP PHOTO/Mandel NGAN (Photo credit should read MANDEL NGAN/AFP/Getty Images)
A gate leading to the Homeland Security Department headquarters in northwest Washington, Friday, June 5, 2015. China-based hackers are suspected once again of breaking into U.S. government computer networks, and the entire federal workforce could be at risk this time. The Department of Homeland Security said in a statement that data from the Office of Personnel Management _ the human resources department for the federal government _ and the Interior Department had been compromised. (AP Photo/Susan Walsh)
White House Press Secretary Josh Earnest answers questions on the massive cyber-attack on the personal data of government employees June 5, 2015 during the daily briefing in the Brady Briefing Room of the White House in Washington, DC. The US government on Thursday admitted hackers accessed the personal data of at least four million current and former federal employees, in a vast cyber-attack suspected to have originated in China. AFP PHOTO/Mandel NGAN (Photo credit should read MANDEL NGAN/AFP/Getty Images)
WASHINGTON, DC - JUNE 05: The Theodore Roosevelt Federal Building that houses the Office of Personnel Management headquarters is shown June 5, 2015 in Washington, DC. U.S. investigators have said that at least four million current and former federal employees might have had their personal information stolen by Chinese hackers. (Photo by Mark Wilson/Getty Images)
WASHINGTON, DC - JUNE 05: The entrance to the Theodore Roosevelt Federal Building that houses the Office of Personnel Management headquarters is shown June 5, 2015 in Washington, DC. U.S. investigators have said that at least four million current and former federal employees might have had their personal information stolen by Chinese hackers. (Photo by Mark Wilson/Getty Images)
WASHINGTON, DC - JUNE 05: The Theodore Roosevelt Federal Building that houses the Office of Personnel Management headquarters is shown June 5, 2015 in Washington, DC. U.S. investigators have said that at least four million current and former federal employees might have had their personal information stolen by Chinese hackers. (Photo by Mark Wilson/Getty Images)
White House press secretary Josh Earnest speaks about the Chinese hack of the computer system of the Office of Personnel Management, Friday, June 5, 2015, during the daily press briefing at the White House in Washington. (AP Photo/Evan Vucci)
Graphic shows details of recent notable data breaches by organization; 3c x 6 inches; 146 mm x 152 mm;
FILE - This Feb. 24, 2015, file photo, shows the Homeland Security Department headquarters in northwest Washington. The Department of Homeland Security said in a statement Thursday, June 4, 2015, that data from the Office of Personnel Management and the Interior Department had been hacked. (AP Photo/Manuel Balce Ceneta, File)
The American flag is reflected in a window at the Theodore Roosevelt Building, headquarters of the U.S. Office of Personnel Management (OPM), in Washington, D.C., U.S., on Friday, June 5, 2015. The disclosure by U.S. officials that Chinese hackers stole records of as many as 4 million government workers is now being linked to the thefts of personal information from health-care companies. The hackers, thought to have links to the Chinese government, got into the OPM computer system late last year, according to one U.S. official. Photographer: Andrew Harrer/Bloomberg via Getty Images
Vehicles drive past the Theodore Roosevelt Building, headquarters of the U.S. Office of Personnel Management (OPM), in Washington, D.C., U.S., on Friday, June 5, 2015. The disclosure by U.S. officials that Chinese hackers stole records of as many as 4 million government workers is now being linked to the thefts of personal information from health-care companies. The hackers, thought to have links to the Chinese government, got into the OPM computer system late last year, according to one U.S. official. Photographer: Andrew Harrer/Bloomberg via Getty Images
of
SEE ALL
BACK TO SLIDE
SHOW CAPTION +
HIDE CAPTION

Sources told Reuters that the hackers employed a rare tool to take remote control of computers, dubbed Sakula, that was also used in the data breach at U.S. health insurer Anthem Inc last year.

The Anthem attack, in turn, has been tied to a group that security researchers said is affiliated with China's Ministry of State Security, which is focused on government stability, counter-intelligence and dissidents. The ministry could not immediately be reached for comment.

In addition, U.S. investigators believe the hackers registered the deceptively named OPM-Learning.org website to try to capture employee names and passwords, in the same way that Anthem, formerly known as Wellpoint, was subverted with spurious websites such asWe11point.com, which used the number "1" instead of the letter "l".

Both the Anthem and OPM breaches used malicious software electronically signed as safe with a certificate stolen from DTOPTOOLZ Co, a Korean software company, the people close to the inquiry said. DTOPTOOLZ said it had no involvement in the data breaches.

The FBI did not respond to requests for comment. People familiar with its investigation said Sakula had only been seen in use by a small number of Chinese hacking teams.

"Chinese law prohibits hacking attacks and other such behaviors which damage Internet security," China's Foreign Ministry said in a statement. "The Chinese government takes resolute strong measures against any kind of hacking attack. We oppose baseless insinuations against China."

MANY UNKNOWNS

Most of the biggest U.S. cyber attacks blamed on China have been attributed, with varying degrees of certitude, to elements of the Chinese army. In the most dramatic case two years ago, the U.S. Justice Department indicted five PLA officers for alleged economic espionage.

Far less is known about the OPM hackers, and security researchers have differing views about the size of the group and what other attacks it is responsible for.

People close to the OPM investigation said the same group was behind Anthem and other insurance breaches. But they are not yet sure which part of the Chinese government is responsible.

"We are seeing a group that is only targeting personal information," said Laura Gigante, manager of threat intelligence at FireEye Inc, which has worked on a number of the high-profile network intrusions.

CrowdStrike and other security companies, however, say the Anthem hackers also engaged in stealing defense and industry trade secrets. CrowdStrike calls the group "Deep Panda," EMC Corp's RSA security division dubs it "Shell Crew," and other firms have picked different names.

The OPM breach gave hackers access to U.S. government job applicants' security clearance forms detailing past drug use, love affairs, and foreign contacts that officials fear could be used for blackmail or recruiting.

In contrast to hacking outfits associated with the Chinese army, "Deep Panda" appears to be affiliated with the Ministry of State Security, said CrowdStrike co-founder Dmitri Alperovitch.

Information about U.S. spies in China would logically be a top priority for the ministry, Alperovitch said, adding that "Deep Panda's" tools and techniques have also been used to monitor democracy protesters in Hong Kong.

An executive at one of the first companies to connect the Anthem and OPM compromises, ThreatConnect, said the disagreements about the boundaries of "Deep Panda" could reflect a different structure than that in top-down military units.

"We think it's likely a cohort of Chinese actors, a bunch of mini-groups that are handled by one main benefactor," said Rich Barger, co-founder of ThreatConnect, adding that the group could get software tools and other resources from a common supplier.

"We think this series of activity over time is a little more distributed, and that is why there is not a broad consensus as to the beginning and end of this group."

(Reporting by Joseph Menn in San Francisco; Additional reporting by Jeremy Wagstaff in Singapore, and Ben Blanchard and Paul Carsten in Beijing; Editing by Tiffany Wu)

Read Full Story

People are Reading