Did the Chinese government hack Anthem?
In the guessing game and investigations of the attack on Anthem Blue Cross and Blue Shield, one early hypothesis blamed eastern European cyber mafia. Now, new evidence points further east.
The Anthem hack has a number of a links to Chinese government-sponsored cyber warriors, according to an analysis by ThreatConnect, an Arlington-based digital security firm headed by Adam Vincent.
The malicious software, or malware, used in the Anthem attack shares several features with an attempted data breach of the military contractor VAE and a hacking competition sponsored by China's Southeast University and Beijing Topsec Network Security Technology Company, both of which have ties to the Chinese military, according to ThreatConnect.
Using its own work and open source intelligence, the security firm tried to retrace some of the Anthem attack and follow technical remnants. Among the evidence is an IP address used in both the VAE attack and the website of the hackathon, and varietals of the "Sakula" and "Derusbi" malware families thought to be used by Chinese government-funded "advanced persistent threat" groups.
One of those malware implants, ThreatConnect found, "was configured to communicate with the malicious command and control (C2) domains extcitrix.we11point[.]com and www.we11point[.]com"--likely named to impersonate the legitimate Wellpoint IT.
"The overlap between the competition website and the static command and control infrastructure seen in the Derusbi/Sakula implant is was likely an error made by the attackers," ThreatConnect analysts write.
One of the possible hacking leaders is Song Yubo, a researcher at Southeast University who conducts research for China's Ministry of State Security, according to ThreatConnect's analysis.
"If the MSS was involved, we can deduce that the Anthem hack could have been for the purposes of gathering sensitive information for follow-on (human intelligence) targeting via blackmail, asset recruitment or technical targeting operations against individuals at home," ThreatConnect analysts write.
There are a few things supporting that hypothesis, they argue. For one, there are no indications that any personal data from the 80 million or so current and former Anthem customers are being sold on the black market, as happened not long after the Home Depot breach.
Unlike the Sony Pictures hack that exposed and made public all kinds of company documents, emails and unreleased movies, the "Anthem compromise was purportedly very covert, a fact which may suggest something about the adversary's motives." And, per those motives, there is the fact that Anthem Blue Cross and Blue Shield plans cover 4.6 million federal government employees, dependents and retirees.
Chinese hackers also were apparently behind an attack on the U.S. Office of Personnel Management, whose IT holds data on 5 million federal workers and security-cleared contractors, as well as the company US Investigations Services, which performs background checks for the Department of Homeland Security.
"All in all, it would seem that China is pursuing a unified approach to cyber operations, relying on all unique facets of the workforce"-- academia, private industry and independent hackers--"to achieve their strategic goals," argue ThreatConnect analysts. "The Anthem breach exposes the insidious reality of modern Chinese cyber espionage as it continues its unrelenting strikes at the soft underbelly of the American way of life."
Hacking the Blues The nation's second largest insurer has to find its way out of what may be the largest healthcare data breach ever.
