Security News > 2021 > February > Chinese Hackers Had Access to a U.S. Hacking Tool Years Before It Was Leaked Online

On August 13, 2016, a hacking unit calling itself "The Shadow Brokers" announced that it had stolen malware tools and exploits used by the Equation Group, a sophisticated threat actor believed to be affiliated to the Tailored Access Operations unit of the U.S. National Security Agency.

"The caught-in-the-wild exploit of CVE-2017-0005, a zero-day attributed by Microsoft to the Chinese APT31, is in fact a replica of an Equation Group exploit codenamed 'EpMe,'" Check Point researchers Eyal Itkin and Itay Cohen said.

DanderSpritz was among the several exploit tools leaked by the Shadow Breakers on April 14, 2017, under a dispatch titled "Lost in Translation." The leak is best known for publishing the EternalBlue exploit that would later power the WannaCry and NotPetya ransomware infections that caused tens of billions of dollars' worth of damage in over 65 countries.

Check Point's findings are not the first time Chinese hackers have purportedly hijacked NSA's arsenal of exploits.

In May 2019, Broadcom's Symantec reported that a Chinese hacking group called APT3 also had repurposed an NSA-linked backdoor to infiltrate telecom, media, and manufacturing sectors.

"The mere fact that an entire exploitation module, containing four different exploits, was just lying around unnoticed for four years on GitHub, teaches us about the enormity of the leak around Equation Group tools."

News URL

http://feedproxy.google.com/~r/TheHackersNews/~3/cBTKbRgGhns/chinese-hackers-had-access-to-us.html