Not just in the United States, but add Canada as well. Seems there could be many moving parts to this and many questions. Apparently this is a big enough issue that Barack Obama dispatched one of his pesky sternly worded letters to China.
Operation Fox Hunt
Obama Administration Warns Beijing About Covert Agents Operating in U.S.
NYT: WASHINGTON — The Obama administration has delivered a warning to Beijing about the presence of Chinese government agents operating secretly in the United States to pressure prominent expatriates — some wanted in China on charges of corruption — to return home immediately, according to American officials.
The American officials said that Chinese law enforcement agents covertly in this country are part of Beijing’s global campaign to hunt down and repatriate Chinese fugitives living abroad and, in some cases, recover allegedly ill-gotten gains. The Chinese government has officially named the effort Operation Fox Hunt.
The American warning, which was delivered to Chinese officials in recent weeks and demanded a halt to the activities, reflects escalating anger in Washington about intimidation tactics used by the agents. And it comes at a time of growing tension between Washington and Beijing on a number of issues: from the computer theft of millions of government personnel files that American officials suspect was directed by China, to China’s crackdown on civil liberties, to the devaluation of its currency.
Those tensions are expected to complicate the state visit to Washington next month by Xi Jinping, the Chinese president.
The work of the agents is a departure from the routine practice of secret government intelligence gathering that the United States and China have carried out on each other’s soil for decades. The Central Intelligence Agency has a cadre of spies in China, just as China has long deployed its own intelligence operatives into the United States to steal American political, economic, military and industrial secrets.
In this case, American officials said, the Chinese agents are undercover operatives with the Ministry of Public Security, China’s law enforcement branch charged with carrying out Operation Fox Hunt.
The campaign, a central element of Mr. Xi’s wider battle against corruption, has proved popular with the Chinese public. Since 2014, according to the Ministry of Public Security, more than 930 suspects have been repatriated, including more than 70 who have returned this year voluntarily, the ministry’s website reported in June. According to Chinese media accounts, teams of agents have been dispatched around the globe.
American officials said they had solid evidence that the Chinese agents — who are not in the United States on acknowledged government business, and most likely are entering on tourist or trade visas — use various strong-arm tactics to get fugitives to return. The harassment, which has included threats against family members in China, has intensified in recent months, officials said.
The United States has its own history of sending operatives undercover to other nations — sometimes under orders to kidnap or kill. In the years after the Sept. 11 terrorist attacks, the C.I.A. dispatched teams abroad to snatch Qaeda suspects and spirit them either to secret C.I.A prisons or hand them over to other governments for interrogation.
Both China’s Ministry of Public Security and the Ministry of Foreign Affairs did not respond to faxes requesting comment. But Chinese officials have often boasted about their global efforts to hunt economic fugitives, and the state media has featured reports detailing the aims and successes of Operation Fox Hunt. Many more details here.
Add in Canada
Chinese police run secret operations in B.C. to hunt allegedly corrupt officials and laundered money
Chinese police agents have been conducting secret operations in Canada — a top destination for allegedly corrupt officials — seeking to “repatriate” suspects and money laundered in real estate.
Vancouver city officials will not comment on co-operation with Chinese agents in “Operation Fox Hunt,” or on suspects pointed to by Chinese news services.
Xinhua news agency reported that while China does not have extradition treaties with Canada, the United States and Australia — the three top destinations for corruption suspects — in 2013 Canada and China signed an agreement to share assets connected to corruption.
Starting in 2014, Chinese agents came to Canada and other countries, Xinhua reported.
The Province found indications in various data sources of large wealth allegedly misappropriated in China and invested in condo and commercial developments and private residences in and around Vancouver.
Also, according to The Province’s review of data posted by the International Consortium of Investigative Journalists, there are a number of offshore shell companies linked to addresses in Vancouver, West Vancouver and Richmond, with connections to Mainland China.
City Manager Penny Ballem was asked if Vancouver officials are taking any actions against money laundering.
“In terms of corruption and money laundering, I can tell you in my conversations with (Vancouver Police Chief) Jim Chu, and the provincial solicitor general, these things are always a challenge for all levels of government,“ Ballem said. “If you want any hard information, you need to talk to Jim Chu.” Many more details of course are here.
France is helping as well?
France offers to help China catch fugitives in Operation Fox Hunt
Why could they also be hackers?
In part: Aliya Sternstein, writing in the August 13, 2015 edition of NextGov.com, notes that the “malicious code the Russians reportedly used to jimmy open a White House network, was also reportedly used by Chinese hackers to rupture Anthem’s network, — and, the malware was free.” Ms. Sternstein adds that “the [malicious ] worms were delivered the same way, via phishing emails that looked legitimate; but, actually baited recipients into opening a malicious file.”
“The hackers’ success in each case — underscores how conventional hacking techniques still work against skilled professionals at high-security organizations,” said Patrick Belcher, a Director at the cyber security firm, Invincea. Mr. Belcher co-wrote a paper detailing the initial penetrations at the White House and Anthem,” Ms. Sternstein noted. “These aren’t just any dumb users,” Belcher said. “The top-notch security professionals failed in their jobs not to open suspicious email links.”
“At Anthem, a bogus message in December 2014, tricked the recipient to install what appeared to be an authentic Citrix software update that was really an infected file,” according to past research, Ms. Sternstein wrote. And, last fall, “at the White House, a video of a 2007 Super Bowl ad for CareerBuilder.com ad floated around that showed chimpanzees running a corporation and tormenting their human employee,” according to F-Secure. A State Department email account reportedly was the source of the phishing email that landed at the White House,” NextGov.com noted.
Why could they be spies?
Newly discovered Chinese hacking group hacked 100+ websites to use as “watering holes”
Emissary Panda group penetrated the networks of industrial espionage targets.
In part from Arstechnica LAS VEGAS—Today at the Black Hat information security conference, Dell SecureWorks researchers unveiled a report on a newly detected hacking group that has targeted companies around the world while stealing massive amounts of industrial data. The majority of the targets of the hacking group were in the automotive, electronic, aerospace, energy, and pharmaceutical industries. The group, believed to be based in China, has also targeted defense contractors, colleges and universities, law firms, and political organizations—including organizations related to Chinese minority ethnic groups.
Designated as Threat Group 3390 and nicknamed “Emissary Panda” by researchers, the hacking group has compromised victims’ networks largely through “watering hole” attacks launched from over 100 compromised legitimate websites, sites picked because they were known to be frequented by those targeted in the attack.
At least 50 organizations in those industries in the US and the United Kingdom had data stolen by members of Emissary Panda. Sites targeted included the website of the Embassy of the Russian Federation in the US (as well as those of other embassies and non-governmental organizations); government agency websites around the world; manufacturing companies, many of whom were suppliers to defense contractors; and the Spanish defense manufacturer Amper. A cultural site for the Chinese Uyghur ethnic group was also used, apparently to target members of the Muslim minority for surveillance.
No zero-day vulnerabilities were used to breach targeted networks, instead “the group relied on old vulnerabilities such as CVE-2011-3544“—a near-year-old Java security hole—”and CVE-2010-0738 to compromise their targets,” Dell SecureWorks’ researchers reported. The group used a number of tools common to other Chinese hacking groups, but they had a few unique tools of their own with interfaces developed for Standard (Simplified) Chinese. One of these is the PlugX remote access tool, “a notorious piece of malware linked to a number of attacks and to another Threat Group, which researchers believe is also likely based out of China,” according to Dell SecureWorks researchers. It also appears the group used China’s Baidu search engine to perform reconnaissance on targets.
