Google has issued a warning against a China-backed cyber-espionage campaign that targeted diplomats in Southeast Asia earlier this year. The tech giant’s Threat Intelligence Group, which attributed the attacks to the hacking group UNC6384, said the campaign likely supports China’s strategic interests. The attacks involved social engineering and malware disguised as software updates. Patrick Whitsell, a senior security engineer at Google, citing technical evidence, confirmed that about two dozen victims downloaded the malicious software. In a statement to Bloomberg, Whitsell said that he is confident that the attackers were “China-aligned,” and also claimed that these hackers can either be a part of the government or were outside contractors.However, Google did not specify the nationalities of the affected diplomats. Moreover, the report also mentions that the term “UNC” is used for hacking activity that is connected to a group but hasn’t yet been classified under a specific group.
How these China-backed hackers may have targeted diplomats
According to Google, hackers compromised Wi-Fi networks of their targets and used that access to trick diplomats into installing malware disguised as an Adobe plug-in. The malware, called SOGU.SEC, was loaded directly into the device’s memory to evade detection, Whitsell explained.“I would assume diplomats have pretty sensitive documents on their laptops that they’re using for their day-to-day work. And yeah, once you’re on that device, you can get those documents,” Whitsell added, noting that he wasn’t able to see how much data was sent out or lost.The hacking activity report, based on Google’s March findings, highlights growing cybersecurity friction between the US and China. Last month, Microsoft said Chinese state-backed hackers were exploiting software flaws to infiltrate global institutions, while Beijing accused US spies of targeting Chinese military firms through another Microsoft vulnerability. China also recently raised concerns about the security of Nvidia’s China-specific H20 AI chips.
