Enter the Twelve-Headed Cyber Dragon: China's Shadow Hacker Squads

A recent American intelligence report claims a dedicated corps of hacker groups have not only cornered China’s data-based theft market, but that they also have the backing – or even the direction – of the Chinese government.

U.S. government officials have been sure to not blindly link cyber attacks to the Chinese government, which includes China’s Blue Army, a 30-strong commando cyberwarrior unit that claims to operate “for defensive reasons only.” (There’s no explicit mention of Blue Army in the report.) But there’s some hushed talk, according to the Associated Press, that enough stealthy operations have been traced back to the specific locations of a dozen groups connected to China’s People’s Liberation Army and a half-dozen nonmilitary actors that the U.S. could confidently peg it all on Beijing.

Videos by VICE

So for a nation as big as China, where nearly 490,000,000 people are online, is it at all surprising to hear that the cyberspying heft of the People’s Republic resides in an elite, shadowy core of a dozen or so teams? Not really. The question, here, is why is China employing this sort of 12-headed cyber dragon? And how, if at all, does this shadow bloc mesh with the Blue Army?

Chinese Defense Ministry spokesman clarifies “Cyber Blue” (May 2011)

Cyberattacks emanating out of China are old hat. Until about a decade ago, intel probes mainly homed in on the U.S. government itself – the sort of routine espionage not unlike the Americans and Russians peeping back and forth during the Cold War. Only in the last 10 to 15 years China’s hacks have steadily crept out and begun targeting American defense firms and energy and financial industries. It’s done this even as the potential of its hacking tools, once somewhat sophisticated, for the most part stagnated.

The attacks can be crude and grueling, then, sometimes spanning months or years. Try and imagine burying malware – key-stroke loggers, password theft and decryption, data copy and compressors, pretty much whatever can transfer back to the attacker’s computer, and then disappear itself from infected systems – for even just a week or two. How unrelentingly boring (maddening) would that be? Gaah.

Whatever it takes, I guess, even if making up for lost innovation comes to nothing more than sheer, old-fashioned, maybe even competitive persistence. The investigation, which was carried out by the Office of the Director of National Intelligence, notes how China’s secret hack squads are given “taskings” that outline just how to lay siege to particular technologies or companies within certain American industries. It even appears that two or more teams are sometimes handed the same laundry list of orders, and then go head-to-head to either pull it off first or rein in the largest loot.

All told, China has accrued untold billions of dollars in stolen intellectual property and other sensitive or classified data. If we’re to believe the Blue Army’s strict defensive posturing, it stands to reason that the teams could be responsible for a considerable chunk of this haul. Indeed, oftentimes these aggressions bear distinct signatures that allow American analysts to match specific hacking teams onto specific thefts.

You tell me, then, if the competitive flair is paying off. Because that’s what this is all about, right? The money and power of top-tier competitive global politics.

Knowing full well, now, just what it’s up against, the U.S.has recently done some major posturing and throat-clearing over how to handle the persistent threat of secret Chinese (Russian, too) cyber-espionage. U.S. officials convened with Chinese representatives two weeks ago, warning of the diplomatic repercussions that come with China’s economic spying. A retired Marine general and former vice chairman of the Joint Chiefs of Staff tells the AP that moving forward the U.S. must say, in so many words, “If you come after me, I’m going to find you, I’m going to do something about it. It will be proportional, but I’m going to do something … and if you’re hiding in a third country, I’m going to tell that country you’re there. If they don’t stop you from doing it, I’m going to come and get you.”

Meanwhile, China says the world must collectively address cybersecurity. Liu Weimin, a Chinese Foreign Ministry spokesman, said in a briefing in Beijing over the weekend that the international community must do all it can to “prevent the Internet from becoming a new battlefield.” If Liu knows, as I’m sure he has to, that in the U.S. the Internet already is a battlefield, these could probably be read as subtle, albeit stinging “choice words.”

China’s fire-breathing shadow hack-squads may not be able to outrun the bitchin’ Ferrari that is American cy-ops. That they’re out there, though, is troubling in that we know China is at a point where it feels it can only go after very specific cyber targets with specialized regiments that sometimes battle one another.

There’s no visual proof of this, of course. (This is what the Blue Army looks like, while we’re at it.) But maybe that’s the idea. By keeping the Blue Army at least partially visible, by maintaining its defense-only stance to the public, the dusty, time-suck techniques of China’s new, secret hacking league can carry on with the grunt and risk of casting a wide net beyond the Great Firewall. It’s a symbiotic relationship that, in time, stands to char and melt – maybe even explode – the U.S.‘s efforts. Then it’s just a matter of collecting all the pieces when the dust settles.

h5. CONNECTIONS:

Reach this writer at brian@motherboard.tv. @TheBAnderson