Hacking traced to Iran, China

Dozens of corporations, multiple U.S. agencies hit; Trump’s withdrawal from nuclear treaty may be motivator

SAN FRANCISCO >> Businesses and government agencies in the United States have been targeted in aggressive attacks by Iranian and Chinese hackers who security experts believe have been energized by President Donald Trump’s withdrawal from the Iran nuclear deal last year and his trade conflicts with China.

Recent Iranian attacks on American banks, businesses and government agencies have been more extensive than previously reported. Dozens of corporations and multiple U.S. agencies have been hit, according to seven people briefed on the episodes who were not authorized to discuss them publicly.

The attacks, attributed to Iran by analysts at the National Security Agency and the private security firm FireEye, prompted an emergency order by the Department of Homeland Security during the government shutdown last month.

The Iranian attacks coincide with a renewed Chinese offensive geared toward stealing trade and military secrets from U.S. military contractors and technology companies, according to nine intelligence officials, private security researchers and lawyers familiar with the attacks who discussed them on the condition of anonymity because of confidentiality agreements.

A summary of an intelligence briefing read to The New York Times said that Boeing, General Electric Aviation and T-Mobile were among the recent targets of Chinese industrialespionage efforts. The companies all declined to discuss the threats, and it is not clear if any of the hacks were successful.

Chinese cyberespionage cooled four years ago after President Barack Obama and President Xi Jinping of China reached a landmark deal to stop hacks meant to steal trade secrets.

But the 2015 agreement appears to have been unofficially canceled amid the continuing trade tension between the United States and China, the intelligence officials and private security researchers said. Chinese hacks have returned to earlier levels, although they are now stealthier and more sophisticated.

“Cyber is one of the ways adversaries can attack us and retaliate in effective and nasty ways that are well below the threshold of an armed attack or laws of war,” said Joel Brenner, a former leader of U.S. counterintelligence under the director of national intelligence.

Federal agencies and private companies are back to where they were five years ago: battling increasingly sophisticated, governmentaffiliated hackers from China and Iran — in addition to fighting constant efforts out of Russia — who hope to steal trade and military secrets and sow mayhem. And it appears the hackers substantially improved their skills during the lull.

Russia is still considered America’s foremost hacking adversary. In addition to meddling widely and spreading disinformation during U.S. elections, Russian hackers are believed to have launched attacks on nuclear plants, the electrical grid and other targets.

Threats from China and Iran never stopped entirely, but Iranian hackers became much less active after the nuclear deal was signed in 2015. And for about 18 months, intelligence officials concluded, Beijing backed off its 10-year online effort to steal trade secrets.

But Chinese hackers have resumed carrying out commercially motivated attacks, security researchers and data-protection lawyers said. A priority for the hackers, researchers said, is supporting Beijing’s fiveyear economic plan, which is meant to make China a leader in artificial intelligence and other cuttingedge technologies.

“Some of the recent intelligence collection has been for military purposes or preparing for some future cyber conflict, but a lot of the recent theft is driven by the demands of the fiveyear plan and other technology strategies,” said Adam Segal, director of the cyberspace program at the Council on Foreign Relations. “They always intended on coming back.”

Officials at the Chinese Embassy in Washington did not respond to a request for comment.