Key Points
- A Chinese-linked hacking group, “Mustang Panda,” targeted U.S. officials with Venezuela-themed phishing emails.
- The attack was launched just hours after the U.S. operation to capture Venezuelan President Nicolas Maduro.
- The hackers used a ZIP file containing a headline about the situation in Venezuela to deliver malware.
- The malware was designed to steal data and create a backdoor for ongoing access.
A Chinese-linked hacking group used the recent U.S. operation in Venezuela as bait to target American government and policy officials, according to a new report from cybersecurity researchers. The group, known as “Mustang Panda,” sent out phishing emails with Venezuela-themed headlines in an attempt to steal data and gain access to U.S. government networks.
The researchers at Acronis’s Threat Research Unit discovered the campaign after finding a zip file named “US now deciding what’s next for Venezuela” that was uploaded to a public malware analysis service. The file contained malware that linked back to previous cyberespionage campaigns carried out by Mustang Panda.
The timing of the attack was striking. The malware was compiled just hours after the U.S. operation to seize Venezuelan President Nicolas Maduro began. The hackers were clearly moving quickly to exploit the rapidly developing and high-profile geopolitical event.
It’s unclear who the campaign’s specific targets were, or whether any of them were compromised. However, the malware was designed to steal data and create a persistent backdoor for ongoing access to the targeted computers. Based on past behavior, the researchers suspect the hackers were going after U.S. government entities and other policy-related organizations.
One of the researchers noted that the hackers in this case seemed to be in a rush, leaving behind clues that helped link the attack to Mustang Panda. “These guys were in haste,” he said, adding that the quality of the work was not as good as in previous efforts.
The Chinese embassy in Washington has denied any involvement, saying it “firmly opposes the dissemination of false information about so-called ‘Chinese cyber threats’ for political purposes.”
