US sanctions Chinese cybersecurity company linked to ransomware attack – Times of India

The United States has imposed sanctions on a Chinese cybersecurity firm, Sichuan Silence Information Technology Company, for orchestrating a large-scale cyberattack. According to a Reuters report, the attack, US officials said could have resulted in fatalities. A statement from the US Treasury Department says that the Chengdu-based company and one of its employees, Guan Tianfeng, deployed malicious software in April 2020 to compromise over 80,000 firewalls across thousands of companies globally.
Guan, also known online as “gxiaomao,” was separately charged with conspiracy to commit computer and wire fraud in a Department of Justice indictment unveiled Tuesday. The FBI has offered a $10 million reward for information about the 30-year-old, his company, or their cyber operations.

What the company is accused of

The software not only exfiltrated data but also launched ransomware attacks, crippling corporate networks by encrypting critical information. The Treasury noted that three dozen of the firewalls were part of critical infrastructure, and the attack’s potential consequences “could have caused serious injury or loss of life” if not mitigated.
One targeted energy company, actively involved in oil drilling during the attack, faced risks of equipment failure. The Treasury emphasized that had the cyber intrusion succeeded, it “could have caused oil rigs to malfunction,” potentially leading to catastrophic outcomes.

Not a first

This isn’t the first time the company has faced allegations of malicious activity. In 2021, Meta Platforms, the parent company of Facebook and Instagram, accused Sichuan Silence of running an online influence campaign. The campaign involved a fabricated biologist claiming the US was meddling in the search for COVID-19’s origins.
Ross McKerchar, Chief Information Security Officer at Sophos, a UK-based cybersecurity firm whose routers were among those targeted, described the hackers as demonstrating “relentless determination.” Sophos previously reported that the attacks reflected “a level of commitment to malicious activity rarely seen” in its nearly 40-year history.