Hackers target Airbus suppliers
Sources point to Chinese link in four major attacks seeking commercial secrets and technical documents
so smaller companies are a better target,” he said.
The attack against Expleo was discovered at the end of last year, but the group’s system had been compromised long before, one of the sources said on condition of anonymity.
A VPN, or virtual private network, is an encrypted network that enables employees to access company systems remotely.
Airbus suppliers sometimes operate in a VPN linking them with colleagues at the plane-maker.
The other attacks used the same methods, with the first of them detected at a British subsidiary of Expleo, formerly known as Assystem, as well as Rolls-Royce, which provides engines for Airbus planes.
According to several of the sources, the hackers appeared to be interested in technical documents linked to the certification process for different parts of Airbus aircraft. They also said that several stolen documents were related to the innovative turbo-prop engines used on the Airbus military transport plane A400M.
One of the sources said the hackers were also interested in the propulsion systems for the Airbus A350 passenger jet, as well as its avionics systems controlling the plane.
None of the sources who spoke to AFP could formally identify the perpetrators of the attacks, pointing to the extreme difficulty in obtaining evidence and identification.
Many state-backed and independent hackers are known to disguise their tracks, or they may leave clues intended to confuse investigators or lead them to blame someone else.
But the sources said that they suspected Chinese hackers were responsible, given their extensive record of trying to steal sensitive commercial information and the fact that Beijing has just launched a plane designed to compete with Airbus and US rival Boeing.
State-owned plane-maker Comac has already launched manufacturing of its first mid-range airliner but has struggled to get it certified. Engines and avionics are “areas in which Chinese research and development is weak,” one of the sources said. In its quest to break the stranglehold of Airbus and Boeing on the global aircraft market, Beijing also has ambitions to build a long-haul jet called the C929, which will be developed in partnership with Russia.
Several sources said they believed a group of hackers linked to the Chinese Communist Party, known as APT10, could be behind the attacks.
The US considers APT10 to be state-backed hackers linked to the Chinese intelligence services and military.
But another source pointed to another group of Chinese hackers, known as JSSD, which is believed to operate under the regional security ministry in the coastal province of Jiangsu.
“The JSSD is focused on the aerospace industry,” one source said, explaining that they employ people “familiar with the language, the software and aerospace codes.”