Malware Attack Uses China World Expo Guise

A malware attack dressed up as an e-mail from organizers of the upcoming Shanghai World Expo targeted at least three foreign journalists in China, in the latest sign of increasingly sophisticated cyberattacks from the country.

The e-mail appeared to be sent from the inbox of the Expo news office, but it was not sent by the Expo and may be targeting journalists who signed up to cover the event, a reporters’ advocacy group in China told members in an e-mail on Thursday.

Google drew global attention to cyberattacks from China two months ago, when the company said it had detected hacking attempts from the country partly aimed at the Gmail accounts of Chinese human rights activists. Google also said the attacks had caused the loss of Google intellectual property and that at least 20 other large companies were targeted. Chinese authorities use various methods to keep political dissidents under surveillance, but Google did not blame the Chinese government for the attacks.

There was also no evidence to suggest that the e-mail sent to foreign journalists had any tie to the government. But at least one version of the e-mail, which was sent by an attacker to IDG News Service, clearly targeted people who had filled out a spreadsheet to register for the Expo. The e-mail had a .pdf attachment that exploited a recently patched vulnerability in Adobe Reader, according to scan results on the Wepawet malware analysis Web site.

“There seems to be a [definite] increase in sophisticated, targeted attacks coming out of China,” said Paul Ferguson, a researcher at Trend Micro, in an instant message.

Eastern Europe is a base for many cybercriminals who aim to profit by illicitly obtaining credit-card and banking information from victims. But large-scale attacks from China are often aimed at stealing intelligence or intellectual property, Ferguson said.

The World Expo will be a months-long show in Shanghai this year where dozens of countries will set up displays. The government sees the event as a display of China’s rising influence abroad.

The alert sent out by the reporters’ group in China said .pdf attachments had become a common mode of attack and that antivirus tools often do not pick up the types of malware involved. On Thursday afternoon in China, Kaspersky was the only vendor out of 42 tested by VirusTotal that labeled the file in the fake Expo e-mail as malicious.

China has repeatedly said its laws ban cybercrime including hacking attacks when asked about accusations of government involvement in attacks.