Hackers linked to China suspected of piracy attempts against NGOs

A report shows that a group linked to Beijing has targeted human rights organizations, such as Amnesty International or FIDH, in addition to state targets.

Le Monde

Amnesty International, the International Federation for Human Rights (FIDH), human rights activists in Tibet as well as foreign ministries … a new Report of the computer security company Recorded Future details targeted organizations in the past three years by Redaplha, a group of computer hackers who are acting on behalf of the Chinese government.

The existence of Redaplha, which has been raging since at least 2015, had been revealed in 2018 by A Citizen Lab report from the University of Toronto , which had detected its trace around sites seeking to fly the passwords of Tibetans.

The methods used by the group are classic: it records a large number of domain names resembling those used by its targets , then massively sends emails encouraging to click On these links, where a false site imitating the legitimate site awaits Internet users.

limited means

The techniques used, relatively basic, and the use of online services at low prices suggest that this organization has limited means. According to Récorded Future, this group favors invisibility efficiency and has multiplied little discreet operations rather than launching more targeted operations.

Recorded Future was able to link several purchases of domain names used to try to trap Internet users, thanks to a series of technical indicators and electronic addresses used to buy suspect domain names. Among the targets identified are, in addition to human rights organizations, Radio Free Asia, the media funded by the US State Department, several research groups, foreign ministries (in Portugal, Vietnam) and several organizations In Taiwan, including the American Institute in Taiwan, which takes the place of an American embassy on the island.

So many organizations which “are part of the centers of the Chinese government”, writes the company, which considers that the group is probably a subcontractor of Beijing, and not a direct emanation of the army or Chinese counterintelligence.

/Media reports.