WSJ: Cloud Hopper, a hacking campaign by Chinese state-sponsored group APT10, was far bigger than formerly known, hitting 12+ cloud providers including IBM, HPE
The hackers seemed to be everywhere. — In one of the largest-ever corporate espionage efforts, cyberattackers alleged …
Fox Business
Context & Ripple Effects
Cloud Hopper has been public since December 2018, when sources reported state-sponsored Chinese hackers breached HPE's and IBM's networks and pivoted into their clients' systems; the DOJ followed within days by charging two alleged APT10 members over data theft from at least 45 US tech companies and agencies (DOJ charges). By mid-2019 the known scope was eight IT service providers.
Today's WSJ reporting roughly doubles that footprint: more than 12 cloud providers hit, with the campaign possibly active as late as November 2019 — meaning it ran for nearly a year after the indictment meant to stop it.
First-order effects
IBM and HPE are confirmed as compromised infrastructure rather than just victims of record: their managed-service access to client networks is what APT10 allegedly exploited, so both face renewed questions about securing customer environments they operate.
Second-order effects
Corporate buyers of managed IT services get fresh evidence that outsourcing a network hands an attacker a single point of entry across many clients at once, pressuring service providers to segment and audit privileged access — and giving competitors a security-diligence wedge in enterprise deals.
Third-order effects
An indictment that failed to halt operations through November 2019 underscores that naming state-sponsored hackers imposes little operational cost, pushing the burden of deterrence onto technical defenses and procurement decisions rather than legal action.
The trend: State-sponsored espionage is converging on shared cloud and managed-service infrastructure, where one compromise scales across dozens of downstream corporate victims.
“The final tally of the Cloud Hopper campaign—both in the total potential access to networks and how much data China ultimately stole—remains unknown to researchers and Western officials.” https://www.wsj.com/...
WHOA - Chinese intelligence hacked: IBM, Rio Tinto, Philips, American Airlines Group Inc., Deutsche Bank AG , Allianz SE and GlaxoSmithKline, more https://www.wsj.com/...
This is outright damning for at least one of the cloud providers mentioned. Embarrassing that companies don't log and audit the way they should in the cloud. https://www.foxbusiness.com/ ...
Well, this is concerning. “A Wall Street Journal investigation has found that the attack was much bigger than previously known. It goes far beyond the 14 unnamed companies listed in the indictment, stretching across at least a dozen cloud providers” https://www.wsj.com/...
“The Journal found that Hewlett Packard Enterprise Co. was so overrun that the cloud company didn't see the hackers re-enter their clients' networks, even as the company gave customers the all-clear.” https://www.wsj.com/... https://twitter.com/...
New: WSJ investigation into China's Cloud Hopper cyber espionage campaign finds a scope of victims broader than known, as service providers struggled to kick out hackers. U.S. officials over time grew panicked about federal agency exposure. W/ @rob_barry https://www.wsj.com/...
Chinese hackers are believed to have accessed the secrets of far more big Western companies than previously known—Rio Tinto, Philips, American Airlines, Deutsche Bank, Allianz, GlaxoSmithKline—slipping in through their cloud service providers. @dnvolz https://www.wsj.com/...