The "Big Four": Spotlight on China

The third installment of our “Big Four” series on China is filled with so much great information that it’s our longest episode yet. Lloyd Brown, Principal Analyst for our Custom Intel Team, and Scott Henderson, Principal Analyst for our Cyber Espionage Team, joined our host, Luke McNamara to peel back the layers of China’s cyber capabilities. Similar to past episodes in this series, we started at the beginning of China’s cyber operations—dating back to 2003. Scott and Lloyd took us through a detailed look at all the stages of China’s operations, including the shift in 2015/2016 from being “clumsy and noisy” to stealthy. Lloyd brings up a great point that’s worth hearing about their use of CVE exploits (which came into play with the recent Microsoft Exchange server exploits). We also discussed how China’s cyber activity is driven by economic interests such as the Belt and Road initiative, the nature of their operations surrounding global elections, APT41’s cybercrime activity in addition to cyber espionage, and where they think China’s operations are headed. You’ll definitely want to stick around to the very end. Since our initial recording occurred before the Microsoft Exchange exploits, Luke decided to follow up with Lloyd to get his take on HAFNIUM and the UNC groups we’re tracking related to that activity. Know the threats that affect your organization with up-to-the-minute threat intelligence by signing up for Mandiant Advantage Free: http://feye.io/MA