Anna Forrester
ThreatConnect and Defense Group Inc. have released a joint report that attributes a cyber espionage campaign focused on disputes in the South China Sea to a unit of the People’s Liberation Army in China.
The “Project CAMERASHY: Closing the Aperture on China’s Unit 78020” report covers the companies’ investigation into the activities of a group they named “Naikon” that could be behind the campaign, ThreatConnect said Thursday.
“This research is a perfect example of how true threat intelligence is highly informative and offers organizations a powerful glimpse into just how sophisticated cyber campaigns operate,” said ThreatConnect CEO Adam Vincent.
ThreatConnect and DGI said Naikon has been known to the security community and has targeted the Association of Southeast Asian Nations and the governments of Singapore, Vietnam and the Philippines, among others.
Both companies  used publicly-available data and applied statistical analysis and data visualization techniques, as well as the Diamond Model of Intrusion Analysis, to identify patterns and connections in the attacks.
According to ThreatConnect, PLA Unit 78020 has utilized global midpoint infrastructure to proxy the deployment of malware over a five-year period.
The cyber campaign has strategic implications for the U.S. in terms of its military alliances and commercial interests in the Asia-Pacific region, the company added.
