Taipei: According to a report by Al Jazeera, a hacking group at the direction of the Chinese government has conducted espionage campaigns against governments, non-governmental organizations (NGOs), think tanks, and news agencies of several countries over the years. Driven. The hacking group, known as RedAlpha, specializes in stealing login details of individuals working in organizations in other countries of strategic importance to Beijing, according to a report released by cyber security firm Recorded Future. Is.
According to Recorded Future, organizations that have been targeted by RedAlpha for credential-phishing since 2019 include the International Federation for Human Rights (FIDH), Amnesty International, and the Mercator Institute for China Studies (MERICS), Radio Free Asia (RFA). ), Taiwan-based American Institute, Taiwan’s ruling party Democratic Progressive Party (DPP), and India’s National Information Center (NIC).
RedAlpha targets organizations by sending emails with PDF attachments
According to a Massachusetts-based cyber security firm, RedAlpha targeted the above organizations by sending an email containing a PDF attachment. The PDF attached in this mail once clicked leads to a fake portal page, which is used to steal login credentials. Recorded Future said that RedAlpha targeted Taiwan-based organizations and human rights groups to gather intelligence on self-governing democracy, and ethnic and religious minority groups, respectively.
These hackers use many methods to achieve their target.
Al Jazeera quoted cybersecurity researcher and founder of the Earhart Business Protection Agency, Hanna Linderstal, as saying, “The method used by RedAlpha Group is a very common technique among hackers. These hackers use many methods to achieve their target. But often the easiest means of stealing intelligence by these hacking groups are often an employee of an organization sitting at a keyboard. The IT department of any institution or organization is generally well prepared for cyber attacks, and hackers know this very well. Hence the weak link proves to be the employees of the organization or the institution.
RedAlpha was first recognized by CitizenLab of Canada in 2018
Researchers at Recorded Future said that many organizations, especially government institutions, have been slow to adopt multi-factor authentication. For this reason, hackers only need a stolen password to access such a website. RedAlpha was first recognized by CitizenLab of Canada in 2018 and is believed to have started operating around 2015. Recorded Future said the RedAlpha hacking group is acting as a proxy for the Chinese government and that its targets are clearly of strategic importance to Beijing.
