Prosecutors chose to focus on the group’s criminal activity in the indictments and didn’t explicitly allege that Chengdu 404’s illicit activities were ‘state sponsored’. The answer is yes, yes, yes, and then some.

The indictments put to bed any lingering doubts about whether the same crew that hacked and defrauded video game companies also performed stunning software supply-chain attacks and hacked telcos to slurp up the communications of dissidents living abroad. Three public indictments put a name (‘Chengdu 404’) and five faces to one of the world’s most capable hacking teams. The US Department of Justice has outed the front company for APT41 (aka Barium), naming five of its hackers in indictments and announcing the arrest of two Malaysian accomplices that helped launder funds for the organisation. The allegations are detailed in separate items below.

The indictment of a further three Iranians connected to Elfin/APT33 that attacked global targets in the aerospace industry.

The indictment of two Iranians (one connected to APT34/OilRig) accused of hacking for the country’s intelligence services and profiting from the sale of stolen data.

Sanctions against an Iranian company (‘Rana’) accused of being a front for APT39/Chafer, and sanctions against 45 Rana staff.

The indictment and arrest of two Malaysians accused of helping Chengdu 404 launder digital currency stolen in attacks.

The indictment of three employees and two freelancers that worked for Chengdu 404, a Chinese front company for APT41/Barium.

The indictments exposed ‘front companies’ for intelligence services in both countries that engage in cybercrime and espionage operations. The US Department of Justice has doxxed over 50 state-sponsored hackers from China and Iran in a spree of indictments and sanctions. The FBI is doxxing APTs like there’s no tomorrow You can subscribe to the weekly Seriously Risky Business newsletter at our SubStack page.

Teamviewer hacked 2017