Researchers Out Front Companies for Chinese Intelligence

A Chinese civilian intelligence agency is at the center of a network of semi-autonomous organizations that power the elaborate and ever more sophisticated world of Beijing cyberespionage.

See Also: OnDemand | North Korea’s Secret IT Army and How to Combat It

Chinese nation-state hacking depends on a network of private sector companies that contract with the Ministry of State Security, which in turn supports research into zero-day vulnerabilities and malware, says Recorded Future’s Insikt Group.

Government officials and researchers have steadily added these companies to the list of known hacking contractors, often based in the Sichuan city of Chengdu. Recorded Future now says it uncovered a previously undocumented front company acting as cover for the MSS. The Beijing Institute of Electronics Technology and Application’s remit is to “research, develop, import and sell technologies that almost certainly support intelligence, counterintelligence, military and other missions relevant to China’s national development and security,” reads the report.

The research suggests that the MSS has become more aggressive in cultivating a “vast network of front organizations and co-optation of entities for intelligence activities.” The evidence includes cybersecurity companies engaged in offensive operations, “universities leveraged for intellectual property theft, non-profit organizations used for social influence and now – almost certainly – research institutes and their subordinate firms established to provide technology enablement.”

The MSS itself very likely evaluates for their offensive potential vulnerabilities submitted to national databases under a law mandating their disclosure (see: Breach Roundup: Did China Have a Sneak Peek Into ToolShell?).

Multiple security companies have observed an uptick in Chinese hacker use of zero-days since the law went into effect in September 2021. The ministry in turn likely distributes exploits to Chinese threat actors.

BIETA “almost certainly” contributes to state research on steganographic capabilities used by Chinese hackers to deploy malware and by Chinese intelligent agents to covertly communicate. Computer vulnerabilities is one of its acknowledged primary research areas.

“Of 87 academic publications with at least one BIETA-affiliated author between 1991 and 2023, at least 40 -46% – are related to steganography, based on keyword searches of their titles and abstracts,” Recorded Future said. The research institute has also hosted multiple events on the topic, including last October the “18th National Information Hiding and Multimedia Information Security” conference.

Other areas of focus for BIETA and its subsidiary, Beijing Sanxin Times Technology Co., include cryptography, networking and penetration testing, miniaturizing technology – such as antennas – and obtaining and developing forensic technology applications, “including methods of identifying video files that have been tampered with text forgeries, fabricated images.”

The risk posed by BIETA is that anything it gathers can be used to further Beijing’s aims, including supporting its regular cyberespionage operations against the West, which regularly feature the theft of intellectual property from businesses and government organizations. Any offers by the institute to engage in joint research or academic opportunities, or purchase products, could be designed to funnel acquired technology directly into a military and intelligence apparatus that repeatedly targets the West.

“Foreign export control authorities, academic institutions and businesses should consider restricting transactions and other engagements with both BIETA and CIII,” Recorded Future’s report says.

Hackers connected to the MSS have been tied to stealthy and long-running intrusions, including the long-running, stealthy infiltration of global telecommunications firms by the Beijing-backed group tracked as Salt Typhoon.

Even so, “it is important to understand that the MSS was domestically focused in its origins, and it has retained this focus throughout its history, distinguishing it from some other foreign intelligence services around the world,” China Leadership Monitor reports.

Steganography at Work

Multiple Chinese hacking groups have deployed steganography as part of their operations.

A U.S. federal indictment filed in 2021 charged MSS officers, all members of a group tracked as APT40 and run by China’s Hainan State Security Department, of applying steganography to conceal stolen data and malware they uploaded to GitHub (see: US Indicts 4 Chinese Nationals for Lengthy Hacking Campaign).

Also tracked using a variety of other names, including Bronze Mohawk, Kryptonite Panda and Leviathan, APT40 has been active since at least 2009 and tied to attacks that “targeted governmental organizations, companies and universities in a wide range of industries – including biomedical, robotics and maritime research – across the United States, Canada, Europe, the Middle East and South China Sea area,” according to the indictment.

Other Chinese nation-state groups have used steganography in their attacks. These include APT15 – possibly part of Xi’an Tianhe Defense Technology Co. Ltd. – which “has used steganography to stealthily deploy malware while avoiding detection” as well as APT1, Recorded Future said.