This indictment extends a prosecutorial arc the DOJ has been building for years: charges against two alleged APT10 members in December 2018 over breaches of at least 45 US tech firms and agencies (APT10 indictment), then four Chinese intelligence officers over the Equifax breach in February 2020 (Equifax hacking charges), and later APT40 and a 12-national espionage case reaching Treasury. Each unsealing names operators the US cannot arrest inside China, making the courtroom record itself the deliverable.
What distinguishes this round is the custody angle: two Malaysian businessmen were actually arrested, suggesting the network relied on regional facilitators reachable by law enforcement — a lever the prior China-based indictments never offered.
First-order effects
Five Chinese citizens now face US charges for hacks against more than 100 companies and institutions, and the two arrested Malaysian businessmen become the first custodial defendants in this case, exposed to prosecution and asset seizure.
Victim companies gain formal attribution — useful for disclosure obligations, insurance claims, and internal threat-intelligence naming — though none of the five charged hackers is in US custody.
Second-order effects
By arresting third-country facilitators rather than only indicting unreachable operators, the DOJ creates pressure on intermediaries in Southeast Asia who monetize or enable state-linked intrusions, raising their operating risk.
Each successive unsealing — APT10, Equifax, APT40, and the later charges against 12 Chinese nationals including PRC staff — gives US agencies a cumulative evidentiary base to justify sanctions, visa bans, and expanded cyber-enforcement budgets.
Third-order effects
If the pattern holds, indictment-by-indictment becomes the standing US response to Chinese state-linked hacking: deterrence pursued through naming, sanctioning, and arresting enablers rather than expecting extradition from China.
Enforcement migrating downstream to money handlers and brokers in third countries points toward a structural split in the ecosystem — protected state-sponsored operators at the core, criminally exposed contractors and cash-out networks at the edges.
The trend: The DOJ is normalizing serial criminal indictments as its primary public weapon against Chinese state-linked hacking, progressively widening targets from the hackers themselves to their third-country facilitators.
Chinese hackers started targeting groups “whose intellectual property would assist China's official Five-Year Plan, the nation's top-level policy blueprint.” Big indictment unsealed today: https://www.nytimes.com/...
Seven International Cyber Defendants, Including “Apt41” Actors, Charged In Connection With Computer Intrusion Campaigns Against More Than 100 Victims Globally - One of the hackers alllegedly boasted of connections to the Chinazi Ministey of State Security https://www.justice.gov/…
I wonder if the “Tan Dailin” named as one of 7 charged by the DOJ today as APT41 actors is the same Tan Dailin (a.k.a. “Wicked Rose") that I wrote about in 2011 as head of a dodgy Chinese antivirus firm called Anvisoft? https://krebsonsecurity.com/ ... https://www.justice.gov/...
Some interesting points for infosec folks: 1) Very rapid turnarounds of publicly disclosed security exploits into active campaigns 2) Most of this group's activities were targeting IoT/router/VPN things that corps are less good at quickly patching https://twitter.com/...
A lot of this indictment also shows another problem generally with foreign intel services and threat intel: the co-mingling of “traditional” criminal action (like cryptojacking) and state-craft-at-arms-length operations
Part of what makes this group “advanced” is leveraging compromises to enable further compromises and persistence. So here, for example, compromising victim #1, stealing their code signing certs, and pushing signed malware to that victim's targeted customers https://twitter.com/..…
DAG Jeffrey Rosen is speaking now. Hackers are part of APT41. The two Malaysian businessmen were arrested on Monday. USG working w/ Microsoft and other companies to disable APT41's infrastructure.
Breaking: Federal prosecutors announce charges against five Chinese hackers — one of whom said he was working with the govt — and two Malaysian businessmen for a scheme that involved intrusions into more than 100 companies across a wide range of industries. Story to come. https:/…
Two Iranian nationals have been indicted on charges of hacking into American computer networks, stealing data for both personal financial gain and at the behest of the Iranian government https://www.politico.com/...