1/ NEW INVESTIGATION: Remember hearing that a People’s Liberation Army (PLA)-linked cyber group hacked 200 Japanese businesses in 2016? While looking into that allegation, we at Recorded Future found something else you should know: a PLA unit is buying popular antivirus in bulk 
2/ So the allegation is PLA Unit 61419 is linked to the advanced persistent threat (APT) actor Tick Group. We need more information to make a firm conclusion there, but circumstantially it makes sense. Both groups have a cyber operations focus on Japan yomiuri.co.jp/national/20210…
3/ While investigating Unit 61419’s recent activities for additional clues, we found multiple military procurement documents showing their inquiries about buying 14 (!) English-language antivirus products throughout 2019
4/ So what? It’s highly unlikely that this PLA unit uses antivirus in English, or that it’s even allowed to use the foreign products it sought to purchase. It is much more likely that Unit 61419 is developing new cyber attack methods to get around these products
5/ There have been at least 4 incidents of China-based APTs exploiting antivirus products since 2017, which also fits within a broader pattern of supply chain cyber attacks in recent years. Moreover, China would not be the first country to buy antivirus for malware development
6/ Returning to Tick Group, in the summer of 2019 they compromised a Trend Micro product just a few months before Unit 61419 issued a purchase order for Trend Micro software. While circumstantial, this is perhaps another piece of the puzzle in the alleged 61419-Tick Group link.
7/ Originally ID’d by @Stokes2049 in 2011, Unit 61419 was a 3PLA signals intel/cyber operations bureau. Our procurement documents confirm it was reorganized into the PLA's Strategic Support Force and that its HQ is in a Qingdao compound who's public face is the Bihaiyuan Hotel
8/ Check out Recorded Future’s full alert at the link below. And make sure you keep your antivirus updated!
recordedfuture.com/china-pla-unit…
recordedfuture.com/china-pla-unit…
Pinging China cyber/mil/espionage researchers: @jonrlindsay @JackieGSchneid @EBKania @McReynoldsJoe @adschina @jmulvenon @DerekSReveron @Fiona_Cunning @NigelInkster @CostelloJK @matthew_brazil @PLMattis @PeterWood_PDW @niubi
• • •
Missing some Tweet in this thread? You can try to
force a refresh
