Chinese State-Sponsored Hacker Arrested for Stealing COVID-19 Research and Law Firm Data

Arrest of Alleged Chinese State-Sponsored Hacker

• 🇨🇳 For the first time in many years, an alleged Chinese state-sponsored hacker, Shu Zouer, has been arrested for computer intrusion crimes against U.S. institutions.
• ⚖️ Shu Zouer and Zang Yu were indicted in 2023 for hacking into three universities and a major international law firm, operating under the control of the Chinese state security bureau as part of the hacker group Haflio or Silk Typhoon.
• 📍 The alleged conduct began in February 2020, with Shu ordered to hack into American universities and mailboxes of individuals involved in COVID-19 research.

Cyber Espionage and Data Theft

• 🦠 Shu allegedly exploited software vulnerabilities to insert webshells, gaining continued access to university email servers and copying gigabytes of COVID research.
• 🏛️ In October 2020, Shu is also alleged to have hacked into the email of a DC-based international law firm to access confidential client information, including US policymakers and government agencies.
• 🔍 Search terms used by Shu allegedly included "Hong Kong," "Chinese sources," and "MSS," referring to China's Ministry of State Security.

International Cooperation and Justice

• ✈️ Shu was arrested in Milan, Italy, after traveling from Shanghai, and awaits extradition to the United States, with gratitude expressed to Italian authorities.
• 🕵️ The FBI highlights this as a rare instance of capturing a hacker linked to Chinese intelligence services, a result of a complex, multi-year investigation spanning multiple countries.
• 💻 In 2021, the FBI conducted a court-authorized operation to remotely access victim computers and remove malicious code, a tactic used to counter advanced adversaries.

Broader Implications and Future Actions

• 💡 The hacking of universities is described as an attack on American scientific innovation, and the hacking of law firms as an attack on the American system of justice.
• 🇺🇸 The FBI emphasizes that the People's Republic of China poses a significant long-term threat to American national security and economic prosperity through its illegal efforts to steal innovation and disrupt businesses.
• ❓ The FBI is still seeking information on the location of Zang Yu, believed to be in China, and asks for public assistance.
• 🤝 The investigation involved significant partnerships between the U.S. Attorney's Office, the FBI, and the DOJ's National Security Division.