Sichuan hackers linked to spying on HK activists

The US Justice Department has charged five Chinese nationals and two Malaysians who ran global hacking operations for at least six years to steal identities, game technology, plant ransomware and spy on Hong Kong activists.

The Chinese were connected to Chengdu 404, a Sichuan firm purporting to offer network security services.

Three of them are accused of hacking computers at hundreds of companies and operations to collect identities, hijack systems for ransom and use thousands of computers remotely to mine for cryptocurrencies.

The other two Chinese, who had worked for Chengdu 404, and the Malaysians were indicted for hacking into major games firms to steal secrets and material such as game chits and credits to sell.

Together, the seven were long recognized by cybersecurity experts as the "APT41" hackers, identified by their tools and techniques.

While some thought the group was run by the Chinese government, the indictments did not identify a strong official connection.

But according to court filings, Chengdu 404 hacker Jiang Lizhi boasted in 2012 that he was protected by China's Ministry of State Security and indicated the group was protected if members did not hack domestically.

"Some of these criminal actors believed their association with the PRC provided them free license to hack and steal," prosecutor Michael Sherwin said in Washington.

And in 2018 Chengdu 404 deployed a program to collect information on people in Hong Kong's democracy movement, on a US group reporting on treatment of Uygurs in Xinjiang and on a Tibetan Buddhist monk.

The seven face a range of charges including computer and wire fraud, identity theft, money laundering, and racketeering.

The Chinese remain at large.