Security researchers with US cybersecurity firm Symantec say they have discovered a “highly sophisticated” Chinese hacking tool that has been able to escape public attention for more than a decade.
The discovery was shared with the US government in recent months, who have shared the information with foreign partners, a US official said.
Symantec, a division of chipmaker Broadcom, published its research about the tool – which it calls Daxin – on Monday.
“It’s something we haven’t seen before,” said Clayton Romans, associate director with the US Cybersecurity Infrastructure Security Agency (CISA).
“This is the exact type of information we’re hoping to receive.”
CISA was announcing Symantec’s inclusion into a joint public-private cybersecurity information sharing partnership, known as the JCDC, on Monday alongside the new research paper.
The JCDC, or Joint Cyber Defense Collaborative, is a collective of government defence agencies, including the FBI and National Security Agency, and 22 US technology companies that share intelligence about active cyber attacks with one another.
The Chinese embassy in the US did not respond to a request for comment.
Chinese officials have previously said China is also a victim of hacking and opposes all forms of cyber attacks.
Symantec’s attribution to China is based on instances where components of Daxin were combined with other known Chinese-linked computer hacker infrastructure or cyber attacks, said Vikram Thakur, a technical director with Symantec.
Symantec researchers said the discovery of Daxin was noteworthy because of the scale of the intrusions and the advanced nature of the tool.
“The most recent known attacks involving Daxin occurred in November 2021,” the research report reads.
“Daxin’s capabilities suggest the attackers invested significant effort into developing communication techniques that can blend in unseen with normal network traffic.”
Daxin’s victims included high-level government agencies in Asia and Africa including ministries of justice, Thakur said.
“Daxin can be controlled from anywhere in the world once a computer is actually infected,” said Thakur.
“That’s what raises the bar from malware that we see coming out of groups operating from China.”
Romans said he did know of affected organisations in the US but there were infections all around the globe, which the US government was helping to notify.
“Clearly the actors have been successful in not only conducting campaigns but being able to keep their creation under wraps for well over a decade,” Thakur said.
AAP
