Cyber-attacks from Chinese IPs surged by 116%

As per the Check Point Research, there is a sharp increase in cyber-attacks aimed for NATO countries that were sourced from Chinese IP addresses, The trend before and after Russia’s invasion into Ukraine, learning that cyber-attacks from Chinese IPs jumped by 116% on NATO countries, and 72% world-wide. The observation indicates a trend that hackers, likely within China and abroad, are increasingly using Chinese IPs as a resource to launch cyber-attacks after the advent of the Russia-Ukraine conflict.

Check Point Research also says that it cannot attribute the cyber-attacks to the Chinese entities or to any known Chinese threat actor, as it is difficult to determine attribution in cyber security without more evidence. But what is clear is that hackers are using Chinese IPs to launch cyber-attacks world-wide, especially NATO countries. Last week, the weekly average of worldwide attacks originating from China per organization was 72% higher than before the invasion and 60% higher than the first three weeks of the conflict and the weekly average of cyber-attacks sourced from China on NATO corporate networks was 116% higher than before the invasion, and 86% higher than the first three weeks of the conflict.

The increase is significantly higher than the overall global increase in cyber-attacks seen during the same timeframes. However, the trend can have many meanings like, the increase can indicate where it is now easy or cheap to set up and operate a service or where it is more opportune to hide the real origin of the attack. It can also indicate how global cyber traffic is being routed at this moment in time.

The Chinese government—officially known as the People’s Republic of China (PRC)—engages in malicious cyber activities to pursue its national interests. Malicious cyber activities attributed to the Chinese government targeted, and continue to target a variety of industries and organizations in the United States, including healthcare, financial services, defense industrial base, energy, government facilities, chemical, critical manufacturing including automotive and aerospace, communications, IT including managed service providers, international trade, education, video gaming, faith-based organizations, and law firms.

Additionally, Advisories published by CISA and other unclassified sources reveal that China is conducting operations worldwide to steal intellectual property and sensitive data from critical infrastructure organizations, including organizations involved in healthcare, pharmaceutical, and research sectors working on COVID-19 response.

S Mohini Ratna, Editor, VARINDIA