Hackers 'try to steal Covid vaccine secrets in intellectual property war'
State-sponsored hackers from China, Russia, Iran and North Korea are engaged in concerted attempts to steal coronavirus vaccine secrets in what security experts describe as “an intellectual property war”.
They accuse hostile-state hackers of trying to obtain trial results early and seize sensitive information about mass production of drugs, at a time when a range of vaccines are close to being approved for the public.
Previously the hackers’ primary intention was to steal the secrets behind the design of a vaccine, with hundreds of drug companies, research labs and health organisations from around the world targeted at any one time.
The cyber struggle involves western intelligence agencies, including Britain’s National Cyber Security Centre, who say they are committed to protecting “our most critical assets”. But they discuss only a fraction of their work in public.
Instead they work behind the scenes with drug companies, research labs and cybersecurity specialists, who are more easily able to describe the everyday hacking attempts in what amounts to a worldwide battle.
Adam Meyers, senior vice-president at the IT security specialists Crowdstrike, said countries including Russia and China had been engaged in hacking western companies and agencies “for the past 20 years”, but since March had “become focused on one topic”, referring to Covid-19.
“What you are seeing here is the latest stage in a long-running intellectual property war, but one where there is much more at stake to those involved. This has become a matter of national pride – who can develop vaccines first.”
Yet, western governments remain reluctant to point the finger of blame in all cases of hacking attacks for fear of diplomatic repercussions, with the UK, for example, particularly cautious about accusing China.
All of the countries accused deny involvement in hacking. Russia has said it has “no knowledge” of hacking attempts, while China has argued its vaccine research is so far ahead it has “no need to steal what others are doing”. Iran denies engaging in cyberwarfare.
Experts in the private and public sector argue otherwise, saying that state-sponsored hacker groups typically have links to spy or defence agencies. This year, the UK’s National Cyber Security Centre said Covid vaccine research labs were being targeted in the UK, US and Canada by Cozy Bear Russian state hackers linked to the FSB internal security agency.
Western experts add that attacks come as frequently from China, Iran and North Korea. In September, Chinese hackers were accused by Spain of stealing Covid research secrets from labs in a “particularly virulent” campaign.
Hackers linked to Iran were accused of trying to steal secrets from US drugmaker Gilead Research in May, in one instance using a fake email log-in page to try to lure a senior executive into giving access to company systems.
British sources indicate they do not believe there has been a successful hack against UK targets – although the assertion is impossible to prove – but it is acknowledged that some cyber-attacks have been successful around the world.
The trend has, however, changed, with hostile-state hackers increasingly targeting production methods and data around the success of trials. It is the kind of information considered of huge importance to nation states as a number of vaccines are poised for global rollout.
Drug companies are typically wellresourced and defended, but some academic institutions less so and researchers have to be educated about the risks, security experts said. “Sometimes researchers are quite surprised when you tell them what can go on,” one IT security specialist added.
Typical attacks include “password spraying” – a simple method used particularly by Russian actors – where generic passwords such as “password123” or “2020” followed by a common word are tried out on a large numbers of accounts.
More sophisticated is the use of “spear phishing” – creating personally targeted emails that invite a person to click a link that installs malware into a company system. It could come in the guise of a Covid-related news item or a message from a would-be recruiter.
At the end of last week, Microsoft said it had detected cyber-attacks from “three nation-state actors targeting seven prominent companies” who were directly involved in researching vaccines and treatments for Covid-19.
Two were judged to have come from North Korea, which used spear phishing lures. One sent “fabricated job descriptions pretending to be recruiters” while the second tried to lure researchers “while masquerading as a World Health Organization representative” according to Tom Burt, a corporate vice-president.
Actors linked to China have also tried to recruit people via LinkedIn, typically posing as an Anglicised young woman with a western first name and a Chinese surname, targeting older men. The hackers pose as a recruiter and try to start a dialogue, eliciting further information that could lead to a phishing attack.
The tactics employed by criminal gangs, who typically threaten to cripple a company’s systems or who encrypt corporate data and demand money for it to be restored in a ransomware attack, have not been used. There is also no evidence of a black market in vaccine secrets.
Jamie Collier, a cyberthreat intelligence consultant at IT security firm FireEye Mandiant, said at state level the focus is “information theft, data exfiltration” in attacks that develop gradually over several phases once entry to a system is achieved. “We don’t see state actors exhibiting a destructive element,” he added.
Martin McKee, a professor of public health at the London School of Hygiene and Tropical Medicine, said he wondered why some states tried to steal vaccine secrets given that so much information about Covid research was put into the public domain.
But he acknowledged that some countries placed a high value on developing hacking capabilities and liked to deploy them. “One plausible interpretation is that these people are doing it simply because they can,” he added.