Orbital satellites have become a new target for hackers using China-based computers.
The mysterious group has been trying to breach satellite communications operators as part of a global cyberespionage campaign, according to security firm Symantec. The apparent aim: to take over computers installed with software that can monitor and control the satellites.
"The hackers had access to satellite systems, meaning they could have done actual damage if they wanted to," Symantec analyst Jon DiMaggio told PCMag. "They only collected info this time, but we can't sit here and say they wouldn't sabotage the systems in the future."
The hacking group, dubbed Thrip, has also been found targeting a geospatial imaging provider, a defense contractor in the US, and three telecommunication operators based in Southeast Asia, Symantec said in a Tuesday report.
Thrip has been active since at least 2013 and been involved in other spying campaigns orchestrated from China. The group's most recent attacks specifically used three computers in the country, according to Symantec. However, the security firm stopped short of blaming the Chinese government for the hacks. Theoretically, anyone could've compromised the three computers, and exploited them as a launching pad to wage the cyberspying campaign.
Symantec noticed the attacks in January, when the company's security software triggered an alert at a "large telecoms operator" in Southeast Asia. During the incident, the group was attempting to install a piece of malware on the victim's network, which exposed the hackers' tactics to Symantec researchers.
To evade detection, Thrip will use a blend of malware and legitimate Microsoft system tools such as PowerShell to steal password information and sensitive data from targeted computers.
In the recent wave of attacks, Thrip was focused on gathering data on the companies from both the US and Southeast Asia. "Espionage is the group's likely motive but given its interest in compromising operational systems, it could also adopt a more aggressive, disruptive stance should it choose to do so," Symantec warned.
This isn't the first time China has been connected to hacks on satellite operators. A US government commission reported in 2011 that China's military may have interfered with at least two US satellites. In 2014, hackers from the country were blamed for breaching a federal weather-monitoring agency, which also maintains its own satellite network. However, officially China has denied any involvement in carrying out state-sponsored hacking.