Chinese government-linked hackers impersonate U.S. AI policy officials for espionage activities

(San Francisco = Yonhap News) Correspondent Kwon Young-jeon = Hackers linked to the Chinese government were found to have carried out a spy operation by impersonating U.S. artificial intelligence (AI) policy officials and AI company executives.

Proofpoint, an American cyber security company, announced on the 1st (local time) that a Chinese government-linked hacking group known as 'TA419' has been conducting phishing attacks targeting AI experts affiliated with major think tanks, universities, and law firms in the United States since April of last year.

According to Proofpoint's report, TA419 impersonated former White House Office of Science and Technology Policy (OSTP) Senior Deputy Director Lynn Parker and economist and foreign policy expert Heidi Krebo-Ridicker during this process.

Hackers attempted to contact the targeted individuals by asking them to participate in AI policy advisory committees or contribute to reports by the Senate Foreign Relations Committee, including on AI export controls.

When the target responded, a link to a phishing page to steal the target's cloud account was sent under the pretext of sharing additional information.

Last February, they carried out a similar attack in the name of a senior executive of the AI ​​company Antropic.

At the time, Antropic was in conflict with the U.S. government regarding the use of its AI model Claude for military purposes, seeking the opinion of an AI policy analyst affiliated with a think tank.

The report said, "TA419 has mainly shown interest in defense, security, energy, international relations, and foreign policy related to the United States and Japan," and added, "Targeting AI policy experts is not outside the scope of these activities, but is an extension of it."

It is said to be an action to understand trends in AI policy and regulatory environment in the U.S. amidst AI strategy competition between the U.S. and China, suspicions of model copying through 'distillation' techniques, and export controls.

The report predicts that TA419 will continue to target think tanks and policy experts in the technology field, and will continue to impersonate the identities of people in the field.

Researcher Mark Kelly, who led the investigation, told CNN, "Given the fact that this hacking group has targeted activities in a way that serves the interests of the Chinese government, the observed infrastructure and technical evidence, and confirmation from industry partners, we are confident that it is a threat actor linked to the Chinese government."

Former Vice President Parker, who is currently Vice President Emeritus of the University of Tennessee, confessed, "I felt saddened by the fact that the relationships I had built throughout my long career were being abused by malicious forces to deceive others. I wanted to warn them, but it was difficult to do so in a situation where I did not know who the target was."

Proofpoint did not reveal who was targeted in this attack, but Reuters reported that there were less than 10 people, including Alex Engler, director of the Center for Media, Technology and Democracy at the University of Pennsylvania, who worked at the White House.

The Chinese Embassy in the United States did not respond to Reuters' request for comment.