The rise of China-based financially motivated threat actors?

Wednesday 4 October 17:00 - 17:30, Small Talks room

Marc Burnard (Secureworks)

Attribution of financially motivated threat actors, particularly those involved in deploying ransomware, has largely pointed at individuals operating from or associated with Russia and Eastern Europe. However, the number of China-based threat actors compromising networks for financial gain appears to be on the rise. In this presentation, we will examine direct observations of intrusion activity over the past two years and ask questions such as: are we seeing an uptick in cybercrime activity emanating from China? Is there overlap between China state-sponsored espionage groups and cybercrime groups? What are the characteristics of an intrusion conducted by a China-based financially motivated threat actor? What are the implications of this overlap for network defenders?

We will draw from unique insights provided by Secureworks’ customer telemetry and incident response engagements to highlight tactics, techniques and procedures (TTPs) observed across a selection of network intrusions attributed to China-based financially motivated threat actors. The presentation will explore links between tools used by these threat actors and open-source tools or research authored by Chinese security researchers, as well as overlap with tools used by China-based espionage groups. Consideration will also be given to how these links form a key component of the attribution assessment and how these financially motivated threat actors can potentially be further broken down into groups that are also conducting state-sponsored espionage activity such as BRONZE ATLAS and BRONZE STARLIGHT, and groups that are either purely financially motivated or have not been associated with espionage activity, such as BRONZE BARONDALE.

Finally, we will identify key characteristics and commonality in TTPs across intrusions conducted by distinct Chinese cybercrime and espionage groups and the implications for network defenders.

Marc Burnard Marc Burnard is a senior security researcher in the Secureworks Counter Threat Unit (CTU) Threat Research team. His focus is on threat intelligence research to understand and mitigate the risk to Secureworks customers from China-based threat actors. Marc has extensive experience in incident response and threat intelligence, and brings Chinese language skills to the role, enabling him to go a step further in understanding China-based threat actors.

Back to VB2023 Programme page

Back to VB2023 conference page

Register for VB2023

Other VB2023 papers