THE US sanctioned a Chinese company it accused of working for intelligence agencies and charged one of its employees with hacking into the computer systems of thousands of businesses across the globe, including American critical infrastructure firms.
The Treasury Department on Tuesday (Dec 10) announced sanctions against Chengdu-based Sichuan Silence Information Technology Company, Limited and one of its security researchers, Guan Tianfeng. Federal prosecutors also unsealed an indictment charging Guan with breaking into more than 80,000 firewalls in 2020 to steal company data and install a ransomware virus.
Guan discovered a previously unknown flaw in a firewall product and used it to deploy malware on the devices, according to the Treasury Department. The purpose was to use the compromised firewalls to steal data, including usernames and passwords. But Guan also attempted to infect the victim’s systems with ransomware, according to the US officials.
Neither Guan nor an attorney for him could be reached for comment. Sichuan Silence and the Chinese Embassy in Washington did not immediately respond to e-mails seeking comment.
The US State Department announced that it’s offering an award of as much as US$10 million for information that helps the government find Guan.
More than 23,000 of the firewalls Guan compromised were in the US and three dozen of those were meant to protect critical infrastructure companies, including one that was drilling for oil at the time of the breach, according to the Treasury Department.
The sanctions freeze any assets of Sichuan Silence and Guan in the US and block business with them, according to the US. Sichuan Silence provides Chinese government intelligence officials with varied hacking and cybersecurity services, US authorities said.
The breached firewalls were sold by Sophos, which patched the vulnerability Guan had used “shortly after the intrusion”, the indictment states. If not for the quick fix by the UK-based cybersecurity firm, the Treasury Department said, the breach could have caused potentially deadly malfunctions on oil rigs.
Ross McKerchar, Sophos’ chief information security officer, welcomed the US actions in a statement. “The scale and persistence of Chinese nation-state adversaries poses a significant threat to critical infrastructure, as well as unsuspecting, everyday businesses,” McKerchar said. BLOOMBERG
