The US Government has charged a Chinese man with helping to perpetuate a year-long cyber attack against US healthcare provider Anthem, as well as several other US businesses.
This is according to an indictment filed earlier this week, which charges 32-year-old Shenzhen resident Fujie Wang (AKA Dennis Wang) with four counts of conspiracy to commit fraud, identity theft and computer hacking. Also charged is another China-based individual, who remains unnamed but goes by aliases including Zhou Zhihong, Kim Young and Deniel Jack. Both are currently being pursued by the FBI.
The filing states that Wang and Jack participated in a hacking campaign lasting 11 months, from February 2014 to January 2015, using spearphishing tactics to gain access to Anthem and other victims. Anthem is the US' second-largest provider of health insurance, boasting more than 74 million customers according to its website, and with revenues exceeding $90 billion as of 2017.
The two individuals were "members of an extremely sophisticated hacking group operating in China", the indictment alleges, which was dubbed 'Black Vine' by Symantec researchers and is likely to be behind a string of attacks from 2012 onwards.
These attacks made heavy use of zero-day vulnerabilities in Microsoft's Internet Explorer, and focused on targets in the aerospace and energy industries. In the case of Anthem, the hackers eventually succeeded in making off with the personal data of almost 80 million people, including medical IDs, employment data, birthdays, social security numbers and more.
In yet another example of hackers exploiting supply-chain vulnerabilities, Wang and his co-conspirators used phishing emails to deploy malware on the network of one of Anthem's subsidiaries. The group then moved on to compromise the network of Anthem itself, eventually gaining access to the company's data warehouse and exfiltrating a large quantity of personal information via the use of Citrix's ShareFile transfer service.
Similar tactics were deployed by the group against three further victims. The companies in question have not been named, but operate in the technology, basic materials and communication services sectors, respectively.
-
Should AI PCs be part of your next hardware refresh?AI PCs are fast becoming a business staple and a surefire way to future-proof your business
-
Westcon-Comstor and Vectra AI launch brace of new channel initiativesNews Westcon-Comstor and Vectra AI have announced the launch of two new channel growth initiatives focused on the managed security service provider (MSSP) space and AWS Marketplace.
-
Google pays largest-ever bug bounty worth £500,000News The company remained tight-lipped over the exploit itself, but speculation is possible given its publicly available rewards breakdown
-
OpenSSL 3.0 vulnerability: Patch released for security scareNews The severity has been downgraded from 'critical' to 'high' and comparisons to Heartbleed have been quashed
-
Hacker steals $566 million from Binance Bridge using proof-forgery exploitNews An exploit discovered in the exchange platform's proof verifier let the hacker take 2m BNB without raising alarm bells
-
CISA issues fresh orders to polish security vulnerability detection in federal agenciesNews The move marks the latest step in the cyber security authority's ongoing ambition to minimise the government's exposure to attacks
-
Mozilla patches high-severity security flaws in new ‘speedy’ Firefox releaseNews Numerous vulnerabilities across Mozilla's products could potentially lead to code execution and system takeover
-
WordPress plugin vulnerability leaves sites open to total takeoverNews Customers on WordFence's paid tiers will get protection from the WPGate exploit right away, but those on the free-tier face a 30-day delay
-
Numerous HP business laptops and desktops vulnerable to publicly disclosed security bugsNews Researchers revealed the details of the six vulnerabilities at Black Hat in August but many laptops, desktops, and workstations remain vulnerable
-
HP patches high-severity security flaw in its own support toolNews The application that's installed in every HP desktop and notebook was allowing hackers to elevate privileges through a DLL hijacking vulnerability
