Airline Hacked by APT41

Posted on June 12, 2021June 12, 2021 by Denise Simon

On March 4, 2021, SITA, an international provider of IT services for the air transport industry worldwide, said it had suffered a security incident. The announcement, however, was not getting the attention it deserved until Air India, one of SITA’s customers, reported a massive passenger data breach on May 21 caused by an earlier attack against SITA. Between March and May, various airline companies, including Singapore Airlines, Malaysia Airlines, and others, disclosed data breaches. All of those companies were SITA customers. After Air India revealed the details of its security breach, it became clear that the carriers were most likely dealing with one of the biggest supply chain attacks in the airline industry’s history.

Using its external threat hunting tools, Group-IB’s Threat Intelligence team attributed the Air India incident with moderate confidence to the Chinese nation-state threat actor known as APT41. The campaign was codenamed ColunmTK.

On May 21, Air India, India’s flag carrier, published an official statement on their website about a data breach. The announcement revealed that the breach was caused by a February incident at the airline’s IT service provider, SITA PSS, which is responsible for processing customers’ personally identifiable information (PII). It came to light that the SITA cyberattack affected 4,500,000 data subjects globally, including data related to Air India’s customers.

***

The FBI defines the APT41 as:

From 2020:

A global hacking collective known as APT41 has been accused by US authorities of targeting company servers for ransom, compromising government networks and spying on Hong Kong activists.

Seven members of the group—including five Chinese nationals—were charged by the US Justice Department on Wednesday.

Some experts say they are tied to the Chinese state, while others speculate money was their only motive. What do we really know about APT41?

Who are they?

Five members of the group were expert hackers and current or former employees of Chengdu 404 Network Technology, a company that claimed to provide legitimate “white hat” hacking services to detect vulnerabilities in clients’ computer networks.

But the firm’s work also included malicious attacks on non-client organisations, according to Justice Department documents.

Chengdu 404 says its partners include a government tech security assessor and Chinese universities.

The other two hackers charged are Malaysian executives at SEA Gamer Mall, a Malaysia-based firm that sells video game currency, power-ups and other in-game items.

What are they accused of?

The team allegedly hacked the computers of hundreds of companies and organisations around the world, including healthcare firms, software developers and telecoms and pharmaceutical providers.

The breaches were used to collect identities, hijack systems for ransom, and remotely use thousands of computers to mine for cryptocurrency such as bitcoin.

One target was an anti-poverty non-profit, with the hackers taking over one of its computers and holding the contents hostage using encryption software and demanding payment to unlock it.

The group is also suspected of compromising government networks in India and Vietnam.

In addition it is accused of breaching video game companies to steal in-game items to sell back to gamers, the Justice Department court filings said.

How did they operate?

Their arsenal ran the gamut from old-fashioned phishing emails to more sophisticated attacks on software development companies to modify their code, which then allowed them access to clients’ computers.

In one case documented by security company FireEye, APT41 sent emails containing malicious software to human resources employees of a target company just three days after the firm recovered from a previous attack by the group.

Wong Ong Hua and Ling Yang Ching, the two Malaysian businessmen, ordered their employees to create thousands of fake video game accounts in order to receive the virtual objects stolen by APT41 before selling them on, the court documents allege.

Is the Chinese government behind them?

FireEye says the group’s targeting of industries including healthcare, telecoms and news media is “consistent with Chinese national policy priorities”.

APT41 collected information on pro-democracy figures in Hong Kong and a Buddhist monk from Tibet—two places where Beijing has faced political unrest.

One of the hackers, Jiang Lizhi, who worked under the alias “Blackfox”, had previously worked for a hacking group that served government agencies and boasted of close connections with China’s Ministry of State Security.

But many of the group’s activities appear to be motivated by financial gain and personal interest—with one hacker laughing in chat messages about mass-blackmailing wealthy victims—and the US indictments did not identify a strong official connection.

Where are they now?

The five Chinese hackers remain at large but the two businessmen were arrested in Malaysia on Monday after a sweeping operation by the FBI and private companies including Microsoft to block the hackers from using their online accounts.

The United States is seeking their extradition.

None of the men charged are known to have lived in the US, where some of their targets were located.

They picked targets outside Malaysia and China because they believed law enforcement would not be able to track them down across borders, the court documents said.

The Under Reported Threat to the US of Smuggling Chinese

Posted on June 8, 2021June 8, 2021 by Denise Simon

We have watched for years the chaos at the U.S. Southern border with Mexico. While there is has been a single focus on Latin Americans crossing into the United States, very little has been reported about the volume of Chinese. This should stimulate some critical thinking and questions.

Is this espionage, operatives or the building of a force for other reasons? In February of 2020, NBC News was asking some of the same questions.

A Chinese student walked around a perimeter fence at a U.S. naval base in Key West, taking pictures of government buildings. Stopped by police, he said he was trying to capture images of the sunrise.

And nine days after that, two more Chinese students drove past a guard at the same naval base. When stopped by security 30 minutes later, they voluntarily displayed the videos and photos they had taken of the base.

The first Chinese student arrested at the naval base in Key West was Zhao Qianli, 20, who was taken into custody on Sept. 26, 2018.

Zhao entered the base by walking along the facility’s secure fence line and trudging through the beach, court documents say.

Zhao headed directly to the Joint Interagency Task Force South property, according to court records, where he took several photographs on his Motorola cellphone and his Canon EOS digital camera.

His devices contained photos and videos of sensitive equipment at the facility’s “antenna farm,” as well as images of warning signs that read “Military Installation” and “Restricted Area,” according to court documents.

Zhao initially told military police that he was “lost” and that he was a “dishwasher from New Jersey.” In later conversations with the FBI, Zhao said he traveled to Key West to “see the sights, such as the Hemingway House,” but there were no images of tourist attractions on his phone, according to his sentencing memo.

Zhao admitted to receiving military training as a university student in China and was found to have a “police blouse” and a People’s Republic of China Interior Ministry belt buckle at his hotel, the memo says.

In 2016, Newsweek in part reported:

Smuggling Chinese across the southern U.S. border appeals to traffickers because it is more lucrative than smuggling individuals from Mexico or Central America. A longer journey commands a steeper price and the going rate per person is believed to be somewhere between $50,000 and $70,000; the total value of the trade for the Chinese mafias involved has been estimated at $750 million.

The role of Chinese mafia groups (triads) in bringing migrants across the border has also deepened their exposure to and ties with Latin American narcotics cartels, both in human smuggling and beyond.

An “alliance between Chinese and Latin American smuggling rings” was noted as early as 1993, but today the scope of this “alliance” encompasses not just smuggling, but also other illicit activity including the sale of drug precursors from Asia and pirated materials.

In Mexico, contact between triads and cartels occurs in various regions, including those ruled by the ruthless Los Zetas syndicate and the Gulf and Juarez cartels, depending on what routes are used for migrants. Triad groups are believed to operate in the Mexican state of Chiapas and the Red Dragon triad, which operates in Peru, is involved not only in smuggling, but also in extortion and drug trafficking within Latin America. The wide-ranging activities of transnational organized crime groups generate additional law enforcement concerns beyond border security.

But it is important to look to the other side of our country, the area of the Bahamas and South Florida. A few islands in the Bahamas are now fully owned by China, one such island is Bird Cay. From Forbes in 2019 in part:

Quoting CaribbeanNews.com directly:

“China has set its sights on The Bahamas and has invested billions of dollars in building new infrastructure and industry across the country.

New roads, new businesses, new hotels, and booming Chinese immigration has led to many companies being staffed with more Chinese workers than local Bahamians.”

Plus, “Reports show that over 200,000 Chinese are illegally smuggled into the Caribbean every year to open their shops or work at Chinese businesses, with many sending their money back to China.”

However, the local government doesn’t see how it’s in a good position to do anything about it since Chinese state banks are simultaneously flooding the islands with tens of millions of dollars… even going so far as to finance new ports there.

Bird Cay, owned now by China

Hold on, there is South Florida where those smuggled Chinese are making their way into the United States aboard some very expensive yachts.

The Miami Herald just last year told us:

Dozens of Chinese nationals without proper papers have been smuggled from the Bahamas to South Florida by operators of luxury yachts who are charging them thousands of dollars each for the short Atlantic journey, according to federal criminal cases.

In recent instances, the Coast Guard stopped two vessels approaching the South Florida shore, leading to the arrests of three men accused of transporting a total of 26 Chinese passengers and one Bahamian, court records show. The alien smuggling operations were not related, however.

Rocco Oppedisano, a 51-year-old Italian national, is scheduled for arraignment in Miami federal court Wednesday on charges of conspiring to transport aliens into the United States and bringing them here for financial gain. Oppedisano told a magistrate judge this week that properties he once owned in the Northeast have been sold along with his Mercedes-Benz, Porsche and Fiat vehicles to pay for legal costs over his immigration troubles.

Oppedisano was stopped by the Coast Guard on Dec. 2 while he was commandeering a 63-foot Sunseeker yacht named INXS FINALLY with 14 Chinese passengers and one Bahamian, according to an indictment. Among the passengers was a Chinese national, Ying Lian Li, who was deported last April but tried to re-enter the country.

It is unclear why these Chinese nationals — unlike Cubans and Haitians smuggled here in both go-fast and rickety boats in the past — sought to come to South Florida. But over the past five years, the Bahamas has experienced an influx of Chinese workers flocking to the archipelago as part of a push by China to invest in the country’s hotel, tourism and trade industries.

In the other alien smuggling case, a Coast Guard cutter encountered a 70-foot Hatteras yacht about 20 miles east of South Florida on July 23, when officers radioed the vessel to ask how many people were on board. The yacht’s response: two crew and eight Japanese passengers with passports, who did not need additional visas to enter the United States.

It was all a lie, according to a Homeland Security Investigations criminal affidavit.

About 10 miles east of Port Everglades, Coast Guard officers boarded the yacht and asked crew member Robert L. McNeil Jr. to bring all the passengers on deck. The officers counted 12 passengers with passports from the People’s Republic of China but without required visas to enter the United States, according to the HSI affidavit.

The Coast Guard concluded that none of the 12 Chinese nationals possessed documents that would allow them to enter the United States legally. McNeil, and the yacht’s charter captain, James A. Bradford, along with the 12 Chinese nationals were transferred to the Coast Guard cutter.

During questioning, Bradford said he left South Florida on the Hatteras yacht bearing the name CAREFREE on July 22 and arrived in Nassau, Bahamas, that day. He admitted that the purpose of the trip was to pick up a “tour group of aliens” in the Bahamas, transport them to South Florida and return to the Bahamas on July 26.

Bradford, who has been a charter captain for decades, said “he never checked to see if the passengers had proper documents to come to the U.S.,” according to the affidavit.

A search of the yacht uncovered 10 cellphones in the bridge area; none of the Chinese nationals had mobile phones on them.

“Based on my knowledge and experience in human smuggling cases, smugglers often collect cell phones from migrants until they are paid for delivering the migrants to the U.S.” wrote HSI special agent David Jansen, who added that none of the passengers carried any luggage.

The search also uncovered $118,100 hidden behind the wall paneling of the yacht’s master bedroom, the affidavit said. Investigators also seized more than $2,800 from McNeil.

Both Bradford and McNeil were indicted on charges of conspiring to transport aliens into the United States and bringing them here for financial gain. To resolve his case, McNeil pleaded guilty earlier this month to one count of alien smuggling to make a profit. He faces up to 10 years in prison.

The Hill says this is a disturbing trend.

Matt Cardy/Getty Images

While it’s unclear why these Chinese nationals sought to come to South Florida, the move is part of a larger five-year trend in the region. The Bahamas has seen a surge of Chinese workers as China invests in the archipelago’s hospitality and tourism industries. China’s presence in the Bahamas reportedly stems from a burgeoning relationship between the two countries, after China provided disaster relief in a bid to establish trade.

But What is NOT in Fauci’s Emails?

Posted on June 7, 2021June 7, 2021 by Denise Simon

That is the question(s)…

While many are calling for the resignation of Dr. Anthony Fauci, I say hold on. Why? Often, in fact most often, former government employees rarely are investigated, charged or prosecuted. I say just suspend him without pay until a full commission is launched.

There are all kinds of people reading through all the released Fauci emails and rightly so. While reading through many articles and posts relating to the emails where so appear to be smoking guns…we must consider what is not in the emails.

As Joe Biden has ordered the intelligence agencies to go through a full review and report back, a long application of strategic thinking is also in order. The reader is invited to ask their own questions in the comments section of this post.

For some context and courtesy of Bloomberg News in part:

No matter where the inquiry leads, the history of lab safety shows, at the very least, that leaks of pathogens have happened in the past — sometimes with deadly consequences. It also shows that even transparent, thorough investigations into the origins of an outbreak can end in uncertainty.

By the late 1970s, smallpox had been eradicated in nature, but work on it continued in a handful of labs around the world, including a facility in Birmingham, England, which had access to a particularly virulent strain. In the summer of 1978, a medical photographer working there named Janet Parker fell ill. When pustules spread across her upper body, a local doctor diagnosed it as a bad case of chickenpox.

It was the third leak of smallpox that decade from a British lab. The British government moved aggressively to contain the outbreak, quarantining hundreds of people and vaccinating many more. Thanks to their efforts, only one other person — Parker’s mother — developed the disease. But Parker died an excruciating, lonely death in an isolation ward — the last known victim of smallpox.

But there were other victims. At the time, the newspapers covering the episode fixated on the director of the laboratory, an expert on pox viruses named Henry Bedson. Despite an absence of evidence, the press blamed him for the outbreak. Quarantined at home and despondent, Bedson went out to his garden shed and slit his own throat; he died soon afterward.

The British government commissioned a thorough investigation into the outbreak. It turned up evidence that Bedson may not have observed sufficient safety protocols and speculated that Parker must have somehow contracted smallpox through contamination in the air ducts. Later, a lawsuit effectively refuted this explanation, leading to the unsettling possibility that Parker herself may have entered one of the work spaces without proper protection. The debate continues to this day.

When lab leaks take place in a secretive society, the difficult job of confirming the source of an outbreak gets much harder. A good case in point was the infamous anthrax outbreak in Sverdlovsk, an isolated city in the Soviet Union.

In 1979, rumors of anthrax killing dozens — or even thousands — began trickling out to the West. Later that year, Soviet journals confirmed some of these reports, noting that upward of a hundred people had contracted anthrax after ingesting contaminated meat; over 60 had died. A tragedy, yes, but perhaps inevitable: Anthrax was endemic in local animal populations.

Intelligence officials in the U.S. weren’t convinced. Satellite imagery showed what looked like decontamination trucks around the city, with considerable activity focused on a mysterious military facility known as Compound 19. CIA analysts hypothesized that the Soviets had mistakenly released a weaponized form of anthrax. More here.

***

Remember, Dr. Fauci has the Director of the NIAID since 1984. He not only knows the history of super bugs and pandemics but he also has access to the files and documentation of global laboratories and scientists.

Can we quit saying ‘lab leaks’, which infers an accident? Perhaps ‘released’ should replace ‘leak’. Anyway, moving on.

Exactly why was the CIA not called in by Fauci or the suggestion of that in 2019 or earlier like around the time of the warning cables that were sent by U.S. Embassy officials back to the State Department in 2018?

How come Dr. Fauci’s emails did not include communication exchanges with other countries that provided big financial aid to the Wuhan Lab like France and Canada?

As the Public Health Agency of Canada refuses to release uncensored internal documents, a Conservative MP says he wants to know how far Canada’s collaboration with China on Level-4 pathogens went — and why two federal scientists were let go by the National Microbiology Lab in Winnipeg in January.

“We need these documents. We need to know what the Government of Canada was doing through the National Microbiology Lab in Winnipeg with respect to cooperating with the Wuhan Institute of Virology in Wuhan, China,” Conservative foreign affairs critic Michael Chong said during a special parliamentary committee hearing on Canada-China relations Monday night.

The special committee has demanded to know why two federal government scientists were escorted out of Canada’s only Level 4 Lab in July 2019, just four months after one of them shipped samples of the Ebola and Henipah viruses to the Wuhan Institute of Virology in China — stories first published by CBC News.

Two months after that shipment, on May 24, 2019, the Public Health Agency of Canada (PHAC) referred an “administrative matter” to RCMP that resulted in the removal of two Chinese research scientists — Xiangguo Qiu and her husband, Keding Cheng — and several international students on July 5.

No where in the Fauci emails is the request for the medical files of ‘patient zero’ or of any Chinese scientists that fell ill or died. Why?

Did Dr. Fauci reach out to the Galveston National Laboratory which is part of the University of Texas for any pandemic details? Not so much, why?

Galveston bio lab explains connections to Wuhan | Local ...

How come Dr. Fauci only had Dr. Deborah Birx as an addition to the White House Virus Task Force and other virology experts were not called on like other world health leaders?

How about any references to expert white papers that Dr. Fauci made? He only said data…what data?

There are hundreds of questions and standing up a full commission is past due. Meanwhile, suspect the doctor and start the real interviews and subpoenas. There are likely hundreds if not thousands more across the world that know more with evidence….Dr. Fauci makes no email inquiries and the same goes for the intelligence agencies, unless they have and that is being embargoed too.

America First Must Build a New Shipping Canal for the Supply Chain

Posted on June 1, 2021June 1, 2021 by Denise Simon

Since 2020 up to now, we in America have suffered through supply chain shortages adding in the matter of ransomware of the Colonial pipeline and now the largest meat processor.

A cyberattack on JBS, the largest meat producer in the world, forced the shutdown of American slaughterhouses, and the closures may be spreading. JBS’s five biggest beef plants in the U.S. halted processing following the weekend attack, equal to one-fifth of all of America’s meat production. Slaughter operations across Australia were also down and one of Canada’s largest beef plants was idled. The prospect of more extensive shutdowns is upending agricultural markets and raising concern about food security as hackers increasingly target critical infrastructure. Livestock futures slumped while pork prices rose. JBS told the White House that the cyberattack, like several previous ransomware assaults, probably originated in Russia.

There are shortages of chicken, chlorine, flour, lumber, computer chips, rare earth minerals like cobalt, rental cars, palm oil, truck drivers, diapers and appliances to list a few. Just imagine the impact of pharmaceuticals via China.

Consider the supply chain dangers if sea shipping was slowed or stopped. Consider the Panama Canal. Why worry?

China is the short answer. And China hates the United States.

In part:

Beijing is currently the second or third largest trading partner with the countries of Central America. Chinese investment in Central America is present in infrastructure projects in Honduras, Nicaragua, Costa Rica, and Panama, and there are plans for further investment in El Salvador and Guatemala. Excluding a contemplated US $50 billion dollars in a canal project in Nicaragua, Chinese investment in Central American infrastructure has totaled approximately US $2 billion thus far.

In a further demonstration of growing ties between the PRC and the countries of Central America, Costa Rica, Panama, and El Salvador have each broken relations with Taiwan to establish diplomatic ties with China. Other countries in the region could soon follow suit.

Panamanian “Panda Bonds”

Sino-Central American investment is being actively pursued in Panama. The country is one of the nations in Latin America that is part of an ambitious program that Beijing has undertaken in the region.

The PRC’s “Silk Road” initiative is a trading and infrastructure plan that aims to connect Asia, Europe, Africa, and Latin America in the same way that the trade route existed during ancient times. In addition to this initiative, further Chinese investment in Central America will result from the Panamanian government’s issuance of US $500 million of “Panda Bonds” in 2018. Panda Bonds are Chinese renminbi-denominated bonds from a non-Chinese issuer that are sold into the Chinese market. Panama issued them in order to take advantage of China’s lower borrowing costs.

***

China’s advancement in Central America dates back to 2007, when Costa Rica became the first Central American country to establish diplomatic relations with Beijing. Since then, economic relations between both countries have developed, helping to promote China’s regional brand. Economically, China has presented itself as an attractive partner. In 2008, China purchased Costa Rican bonds in excess of $300m, offered the country aid worth $130m, and funded the $105m construction of the Estadio Nacional. Meanwhile, on March 2 Chinese state media claimed that China will finance the expansion of a highway connecting Costa Rica and the Caribbean.

Chinese activity in Costa Rica is not limited to finance. In terms of culture, students at the University of Costa Rica can study Chinese and enrol in Chinese cultural programmes. The Chinese government has also promoted the development of Chinatown in San José, Costa Rica’s capital.

What is the solution?

America First should consider mobilizing a real infrastructure operation that would build a new shipping canal that would be technologically more advances and handle larger ships. Where to put it? Nicaragua.

Really? Yes, beat China at their own game and do it fast. The Nicaragua Canal was proposed and backed by Chinese investors and was to be completed in 2020 at an estimated cost of $50 billion.

Nicaragua Canal Proposed Routes

Can you see the natural location for such a shipping canal?

This would also stabilized Latin American countries with economic space and stem the immigration chaos. This time, don’t give the canal away either. The cost? Perhaps a mere $15 billion and these days that is much less than the Biden administration budget has proposed to spend…that pesky $6 trillion.

Has China placed some military operatives in Latin America to protect Chinese investments otherwise known as debt trapping? Seems a legit question especially when the left-leaning think tank Foreign Policy Magazine explains the context just as recently in June of 2020.

Furthermore, Iranian warships are headed to Venezuela with 7 high speed missile boats on board. Additionally, China continues to make plays in the energy sector in Cuba. More debt trapping? Yes.

The America First Policy Institute needs to do some immediate forecasts for national security reasons. The AFPI, which holds a stellar staff list has one particular section called ‘Center for New Frontiers’.

America was not founded to restore an imagined past, but to move its people into a bright and brilliant future. In this first half of the twenty-first century, the United States stands on the precipice of an array of extraordinary possibilities. Dreams from our yesterdays — interplanetary travel, autonomous vehicles, subterranean transit systems, artificial intelligence, 3D printing, organ regeneration, extraordinary new power sources, and beyond — are poised to enter our tomorrows. The America First Policy Institute (AFPI) will research and develop policies that nurture America’s experimental spirit.

A new infrastructure plan such as a shipping canal is just the cure for future supply chain protections and stabilizing countries in our own hemisphere when other key industries and manufacturing must relocate to either or both Central America and back to the United States.

Fauci Lands Book Deal, What about Wuhan?

Posted on June 1, 2021June 1, 2021 by Denise Simon

Dr. Anthony Fauci landed a book deal and will be the subject of a documentary featuring his work during the COVID-19 pandemic despite his constant flip-flopping on virus-related topics such as prolonged lockdowns, school reopenings, and the origins of the coronavirus.

“Expect the Unexpected: Ten Lessons on Truth, Service, and the Way Forward,” the National Institute of Allergy and Infectious Diseases (NIAID) director’s book, will be published by National Geographic Books and available to the public by as early as November 2.

“In his own words, world-renowned infectious disease specialist Anthony Fauci shares the lessons that have shaped his life philosophy, offering an intimate view of one of the world’s greatest medical minds as well as universal advice to live by,” the book description on Amazon reads. More book details here.

Dr. Fauci is the highest paid government employee and frankly should be prosecuted that is before he is fired.

*** Fauci said he tested negative for coronavirus Saturday ...