Yesterday the U.S. Department of Justice unsealed the indictment of two Chinese government hackers.

The Justice Department said,

Through their involvement with the APT10 Group, from at least in or about 2006 up to and including in or about 2018, Zhu and Zhang conducted global campaigns of computer intrusions targeting, among other data, intellectual property and confidential business and technological information at managed service providers (MSPs), which are companies that remotely manage the information technology infrastructure of businesses and governments around the world, more than 45 technology companies in at least a dozen U.S. states, and U.S. government agencies. The APT10 Group targeted a diverse array of commercial activity, industries and technologies, including aviation, satellite and maritime technology, industrial factory automation, automotive supplies, laboratory instruments, banking and finance, telecommunications and consumer electronics, computer processor technology, information technology services, packaging, consulting, medical equipment, healthcare, biotechnology, pharmaceutical manufacturing, mining, and oil and gas exploration and production. Among other things, Zhu and Zhang registered IT infrastructure that the APT10 Group used for its intrusions and engaged in illegal hacking operations.

So, how did they do it? Paragraph 4 of the indictment tells us the four steps:

First, the threat actors used spearphishing emails to deliver malicious software which was embedded in attachments.

Second,  when the recipient opened the attachments, the embedded malware was installed.

Third, after the installation of the initial malware, the threat actors used the initial compromise to install more malware on the compromised systems.

Fourth, the threat actors used the access provided by their malware to steal information from the compromised computers.

Step two glosses over two critical tasks that the recipient was required to perform on behalf of the threat actor:

  1. The recipient had to open the email
  2. The recipient had to open the attachment

Why would people do the work of threat actors?  Because spearphishing is not a data processing problem, it is a problem of psychological manipulation carried out using data processing systems. SP Guard provides a defense against this form of psychological manipulation.