Get the latest tech news
An inside look at NSA tactics, techniques and procedures from China's lens
(Equation Group) TTPs from China’s lense Since I reside in a Five Eyes country (Australia) and have publicly presented four cases I led on China’s APT41 attacking organisations in ASEAN, particularly concerning China’s cyber and political strategies, I was curious to explore what China publishes about Five Eyes operations. This led me down a rabbit hole of research into TTPs that Chinese cybersecurity entities have attributed to the NSA – or, as they coin “APT-C-40”.
These insights stem from extensive research I did on Weixin containing intelligence reports published by China’s Qihoo 360, Pangu Lab, and the National Computer Virus Emergency Response Center (CVERC). Reports claim that the attack was executed by Tailored Access Operations (TAO), a division within the NSA, which allegedly deployed over 40 unique malware strains to conduct data theft and espionage. Through the joint investigation and forensics on the University, CVERC and 360 identified 4 IPs that the NSA supposedly purchased through two cover companies “Jackson Smith Consultants” and “Mueller Diversified Systems”.
Or read this on Hacker News
