Boyusec

2017: Connection with hacker grouping

In May, 2017 anonymous grouping code-named of Intrusion Truth published own research which showed communication of the Boyusec company executing contracts for the government of the People's Republic of China with the hacker grouping known to APT3 code-named. Outputs of Intrusion Truth were confirmed by the Recorded Future company specializing in investigation of global cyberthreats.^[1]

Participants of APT3 used broad tool kit and techniques, including the directed phishing attacks, exploits of zero day and different means of remote administration, including public and independently written. Among the victims - defense contractors, telecommunication and transport companies and also the high-tech enterprises. Public institutions in the USA, Hong Kong and other countries were also exposed to the attacks.

The cybersecurity contractor of the Chinese government was suspected of communications with hackers

APT3 — the hacker grouping which is active since 2010. It is also known under the names Gothic Panda, Pirpi, UPS and TG-011. On its account of theft of intellectual property at private business and espionage for political figures.

After the USA and China signed in 2015 the pact on restriction of transactions against private business in a cyberspace, APT3 grouping switched the attention to other purposes, mainly, of activists and politicians in Hong Kong.

According to researchers of Intrusion Truth, Boyusec it is closely connected with the Guangdong Assessment center of information technology security which, in turn, submits to the Ministry of state security of the People's Republic of China.

Intrusion Truth specify that two shareholders of Boyusec, Wu Yingzhuo and Dong Hao, with own hand registered a number of domains which were used then in the attacks of APT3.

Besides, as analysts of Recorded Future, on the Chinese websites devoted to job search specify, Boyusec placed declarations of search of specialists for the joint project with the mentioned Guangdong Assessment center of information technology security. The project was directed to creation of new technologies of network security and active defense.

Earlier the U.S. Department of Defense announced detection of a backdoor in the equipment in which development Boyusec and Huawei jointly were engaged. By the way, Huawei is the second famous partner of Boyusec, except the Guangdong center. This company does not have others.

Borders of the hacker world are so illusory that it is often difficult to define what was done by group of enthusiasts that was done by state structures and that was done by enthusiasts under cover of state structures — Ksenia Shilak says, the sales director of the Russian company SEC-Consult — Attribution of cyberthreats is always integrated to a large number of problems, but China repeatedly and hardly was bezopasnovatelno accused of intensive cyberespionage activity against other countries.

Notes