Targets

APT40's campaigns have targeted a range of victims originating in the United States, Austria, Cambodia, Canada, Germany, Indonesia, Malaysia, Norway, Saudi Arabia, South Africa, Switzerland and the United Kingdom.^[2] Targeted industries included, among others, aviation, defense, education, government, healthcare, biopharmaceuticals and maritime.^[2][3]

Stolen trade secrets and confidential business information included, among other things, sensitive technologies used for submersibles and autonomous vehicles, specialty chemical formulas, commercial aircraft servicing, proprietary genetic-sequencing technology and data, and foreign information to support China’s efforts to secure contracts for state-owned enterprises within the targeted country (e.g., large-scale high-speed railway development projects).^[2]

In the most concerning instances, hackers from the Hainan SSD targeted research on highly pathogenic biological agents including Ebola, MERS, HIV/AIDS, Marburg and tularemia, several of which have been historically weaponized as biological warfare agents.^[2][3][7]

The indictment charged the Hainan MSS officers with coordinating intelligence requirements with academics at universities in Hainan and elsewhere in China. Not only did such universities assist the MSS in identifying and recruiting hackers and linguists to penetrate and steal from the computer networks of targeted entities, including peers at many foreign universities, but personnel at one identified Hainan-based university also helped support and manage Hainan Xiandun as a front company, including through payroll, benefits and a mailing address.^[2]