Country
country:china
Also: Chinese, Chinese officials
Country associated in the episode with Chinese intelligence activity and the targeting of research and development information.
Country discussed as the suspected origin or sponsor of the campaign and later cyber-espionage activity.
“Rumors started to circulate that China was likely behind this attack.”
“a campaign that the company believes originated in China”
Country associated in the episode with Chinese intelligence activity and the targeting of research and development information.
“Stan’s background, besides him being a Russian operative, his primary target while he was in the GRU was against China.”
“Ira essentially found the Chinese intelligence operation operating across the street.”
Country to which a compromised bank domain controller was observed sending data.
“their domain controller which is the most important server within the network, was actually sending data to China.”
Country referenced in connection with an earlier attack on Google and with Las Vegas Sands properties that the wiper attempted to reach.
“an attack that China did on Google back in 2009”
Country named among possible state actors considered during attribution analysis.
“Russia, China, the US, Israel.”
Neighboring country described as a route for smuggling people, goods, media, and removable storage into North Korea.
“China and North Korea border each other”
Country whose officials received counterintelligence information and used it to identify CIA sources and agents.
“At that point, China started learning the identities and locations of CIA agents who were in China”
Country considered a suspect because code in Olympic Destroyer resembled code associated with APT3.
“China comes up as well”
“a different hacker group called APT3 which is widely understood to be Chinese”
Country associated in the episode with Tencent, 360, and restrictions on participation in foreign hacking competitions.
“two Chinese companies; one Tencent and the other 360”
“the Chinese government wrote a new policy”
Country presented as the possible source or sponsor associated with the World Bank intrusion, with attribution described as uncertain.
“there were a few clues that suggested that this attack came from China”
“it wasn’t necessarily the way that typically you would map your TTPs to a particular actor”
Country described as blocking The Pirate Bay over its freedom-of-speech implications.
“one of the first countries that censored Pirate Bay was China because of – they didn’t like the freedom of speech aspect”
Country associated in the episode with espionage activity against The New York Times, Google, and other organizations.
“we were one of the first companies after Google’s hack in 2009, 2010 that came out and announced that we had been hacked by China”
Country identified in the episode as the base associated with the threat actor and intelligence agency.
“a Chinese intelligence agency known as the Ministry of State Security”
Country identified in connection with production of Team Xecuter chips and an unnamed co-defendant.
“a Chinese guy named Chen”
“overseeing the production of the chips in China”
Country associated in the episode with the threat actors, research devices, and Sichuan Silence Technology Company.
“located in Chengdu in China”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| incoming | ATTRIBUTED_TO | Operation Aurora | Attributed | 19 |
| incoming | ATTRIBUTED_TO | Chinese intelligence operation | Uncertain | 21 |
| incoming | TARGETS | Carbanak | Explicit | 35 |
| incoming | INVOLVES | CIA covert communications compromise | Explicit | 75 |
| incoming | ASSOCIATED_WITH | Iranian intelligence | Attributed | 75 |
| incoming | ATTRIBUTED_TO | World Bank network intrusion | Uncertain | 91 |
| incoming | ASSOCIATED_WITH | Beijing Summer Intern | Uncertain | 98 |
| incoming | ATTRIBUTED_TO | APT10 | Attributed | 103 |
| incoming | TARGETS | Pacific Rim Campaign | Explicit | 174 |
Operation Aurora ATTRIBUTED_TO China
Google believed the campaign originated in China; this attribution was presented by Hillary Clinton as an allegation under investigation.
Attributed Confidence 90% · Hillary Clinton EP 19 Details
“a campaign that the company believes originated in China”
Chinese intelligence operation ATTRIBUTED_TO China
The operation is presented as likely connected to China, but the episode says there was only a high probability and offers multiple possible explanations for the restaurant's activity.
Uncertain Confidence 83% · Jack Rhysider EP 21 Details
“it’s a high probability that this Chinese restaurant was there to steal trade secrets from the company and send them back to China’s government agencies”
The campaign later branched out to countries including China.
Explicit Confidence 96% · Jack Rhysider EP 35 Details
“it did start to branch out to various other countries like Spain and China”
CIA covert communications compromise INVOLVES China
Information from the compromised communications was passed to Chinese officials, who used it against US intelligence sources in China.
Explicit Confidence 98% · Jenna McLaughlin EP 75 Details
“once the information was passed on to Chinese officials, that was one of the key reasons that such a large group of sources in China were killed.”
Iranian intelligence ASSOCIATED_WITH China
Iranian intelligence reportedly shared counterintelligence information with Chinese officials; the episode presents the relationship as reported rather than independently confirmed.
Attributed Confidence 91% · Jenna McLaughlin EP 75 Details
“Iran was sharing this with its allies and our adversaries. That information was passed along, we’re told, not only to Russia but also to Chinese officials.”
World Bank network intrusion ATTRIBUTED_TO China
The attack was not identified with certainty, but clues and some Mandiant analysis suggested it came from China or a Chinese asset.
Uncertain Confidence 88% · Jack Rhysider EP 91 Details
“there were a few clues that suggested that this attack came from China”
“they knew that it was China or some Chinese asset”
Beijing Summer Intern ASSOCIATED_WITH China
The attack was connected to China, but Nicole says it was still unknown whether the actor was the Chinese military or a contractor.
Uncertain Confidence 91% · Nicole Perlroth EP 98 Details
“the Chinese military – we actually still don’t know if it was the military or a contractor – hacked The New York Times”
The indictment identifies the hackers as associated with the Chinese government, while the specific allegations are attributed to the US Department of Justice.
Attributed Confidence 98% · Rod Rosenstein EP 103 Details
“two hackers associated with the Chinese government”
Pacific Rim Campaign TARGETS China
The episode repeatedly describes the actors and their research infrastructure as being located in China, especially Chengdu; this is not a claim that China itself was the victim target.
Explicit Confidence 86% · Craig Jones EP 174 Details
“we found these multiple companies. One of the simplest ways we actually found it, funnily enough — and this sounds so basic — is that we would look at devices that would be continually going up and down firmware versions. These threat actor devices would constantly put the new, latest firmware on, roll it back, new firmware, roll it back. They’d do this, I don’t know, maybe five or six times a day. Whereas normal firewall operation, it’s like, it’s a new firmware and it’s left. Then in a month it gets new firmware and then it’s left. So, these things just stood out like a sore thumb. So, some of it came really easy to find these threat actors. The more telemetry we had the easier it got. We started to really build a wide assortment of threat actors in China”