Exclusive: Wuhan Earthquake Monitoring Center hit by US cyberattack; investigation underway

The Wuhan Emergency Management Bureau, which oversees the Wuhan Earthquake Monitoring Center, said in a statement Wednesday that the Wuhan Earthquake Monitoring Center had recently been subjected to a cyberattack launched by an overseas organization. This is another such case following the cyberattack targeting Chinese universities from overseas in June 2022.

The expert team investigating the case determined that the cyberattack was launched by an overseas government-backed hacker organization and criminal individuals. The Global Times learned that preliminary evidence indicates that the government-backed cyberattack targeting the center originated in the US.

The Wuhan Emergency Management Bureau said in a statement Wednesday that the National Computer Virus Emergency Response Center had detected that some network equipment at the front-end collection points of the Wuhan Earthquake Monitoring Center had been subjected to a cyberattack by an overseas organization. The National Computer Virus Emergency Response Center (CVERC) and Chinese cybersecurity company 360

immediately blocked the affected equipment and reported the case to the public security authorities so that it could be investigated and handled in accordance with the law, and the hacker organization and criminals could be dealt with, the statement said.

The Jianghan Branch of the Wuhan Public Security Bureau confirmed that the Wuhan Earthquake Monitoring Center had discovered a Trojan program originating overseas. According to the Public Security Bureau, the Trojan could illegally control and steal earthquake intensity data collected by the front-end stations. This behavior poses a serious threat to national security.

The public security authorities have opened a case for investigation and are conducting further technical analysis of the extracted Trojan samples. It was initially determined that the incident was a cyberattack launched by an overseas hacker organization and criminal individuals.

Professionals told the Global Times that earthquake intensity data refers to the intensity and magnitude of an earthquake, which are two important indicators for measuring an earthquake’s destructive power.

Experts told the Global Times that these data are closely related to national security. For example, these factors need to be considered when constructing certain military defense facilities. Following the cyberattack by an overseas hacker organization on Northwestern Polytechnical University in June 2022, the Wuhan Earthquake

Monitoring Center has become another state entity to suffer an overseas cyberattack.

After the attack on Northwestern Polytechnical University, CVERC and 360 jointly formed a technical team to conduct a comprehensive technical analysis of the case. They concluded that the cyberattack was launched by the Tailored Access Operations (TAO) of the US National Security Agency (NSA).

The Global Times learned that an expert technical team composed of CVERC and cybersecurity company 360 has arrived in Wuhan to conduct forensic work on the latest case. Preliminary evidence indicates that the cyberattack targeting the Wuhan Earthquake Monitoring Center originated in the US.

According to 360’s monitoring results, the US National Security Agency has launched cyberattacks against at least several hundred important domestic information systems in China. It was found that a Trojan program called “validator” was operating in the information systems of multiple departments and transmitting information to NSA headquarters.

Moreover, the investigation results showed that, not only in China but also in the critical information infrastructure of other countries, large numbers of “validator” Trojans are operating, and the number of such programs implanted in the systems of these countries far exceeds that in China.

The Central Intelligence Agency is another notorious US organization involved in cyberattacks and data theft, alongside the National Security Agency. According to CVERC research, the CIA’s cyberattacks have become automated, systematic and intelligent.

The CIA’s latest cyberweapons employ extremely stringent espionage specifications, with various attack techniques linked together. They now cover almost all internet and Internet of Things assets worldwide, enabling them to control other countries’ networks and steal their important sensitive data at any time and from anywhere.

Observers pointed out that while intensifying attacks on global targets and stealing confidential information, the US also spares no effort to accuse other countries.

It rallies so-called allies, promotes the “China cyber threat theory,” and smears and defames China’s cybersecurity policies, actions that have been repeatedly rebutted by China’s Foreign Ministry.

On July 19, Foreign Ministry spokesperson Mao Ning said at a regular press conference that China is a victim of cyberattacks and firmly opposes such actions.

She said: “For many years, the US has carried out indiscriminate, large-scale cyberattacks against other countries.” “The US Cyber Command openly declared last year that the critical infrastructure of other countries is a legitimate target of US cyberattacks. Such actions have caused concern.”

,