reader comments
22 with
A prolific espionage hacking group with ties to China spent over two years looting the corporate network of NXP, the Netherlands-based chipmaker whose silicon powers security-sensitive components found in smartphones, smartcards, and electric vehicles, a news outlet has reported.
The intrusion, by a group tracked under names including “Chimera” and “G0114,” lasted from late 2017 to the beginning of 2020, according to Netherlands national news outlet NRC Handelsblad, which cited “several sources” familiar with the incident. During that time, the threat actors periodically accessed employee mailboxes and network drives in search of chip designs and other NXP intellectual property. The breach wasn’t uncovered until Chimera intruders were detected in a separate company network that connected to compromised NXP systems on several occasions. Details of the breach remained a closely guarded secret until now.
No material damage
NRC cited a report published (and later deleted) by security firm Fox-IT, titled Abusing Cloud Services to Fly Under the Radar. It documented Chimera using cloud services from companies including Microsoft and Dropbox to receive data stolen from the networks of semiconductor makers, including one in Europe that was hit in “early Q4 2017.” Some of the intrusions lasted as long as three years before coming to light. NRC said the unidentified victim was NXP.
“Once nested on a first computer—patient zero—the spies gradually expand their access rights, erase their tracks in between and secretly sneak to the protected parts of the network,” NRC reporters wrote in an English translation. “They try to secrete the sensitive data they find there in encrypted archive files via cloud storage services such as Microsoft OneDrive. According to the log files that Fox-IT finds, the hackers come every few weeks to see whether interesting new data can be found at NXP and whether more user accounts and parts of the network can be hacked.”
wrote on Mastodon. “It’s likely the TA knows of specific flaws reported to NXP that can be leveraged to exploit devices the chips are embedded in, and that’s assuming they didn’t implement backdoors themselves. Over 2.5 years (at least), that’s not unrealistic.”
documented one two-year hacking spree that targeted semiconductor makers with operations in Taiwan, where NXP happens to have research and development facilities. An attack on one of the unnamed victims compromised 10 endpoints and another compromised 24 endpoints.
“The main objective of these attacks appeared to be stealing intelligence, specifically documents about IC chips, software development kits (SDKs), IC designs, source code, etc.,” Cycraft researchers wrote. “If such documents are successfully stolen, the impact can be devastating.”
