China-linked hackers used Venezuelan President Nicolas Maduro's arrest to target US government officials: Report

Cybersecurity researchers have claimed that China-linked hacking group has run an espionage campaign utilising the high-profile arrest of Venezuelan President Nicolas Maduro to target American government officials. The group, identified as Mustang Panda by cybersecurity firm Acronis, reportedly launched a series of “Venezuela-themed” phishing attacks just hours after the January operation in Venezuela. The report added that the hackers attempted to capitalise on the geopolitical chaos to infiltrate US policy-related entities.

The report (via Reuters) says that the campaign was discovered after a suspicious zip file titled “US now deciding what’s next for Venezuela” was uploaded to a public malware analysis service on January 5. The malware contained within the file reportedly featured code and infrastructure that overlapped with previous Mustang Panda operations.





"These guys were in haste," said Subhajeet Singha, a malware analyst with Acronis, while noting that the hackers’ speed led to a drop in quality compared to their typical efforts.

‘Venezuela-themed’ malware’s capabilities and targets

According to the cybersecurity company, if successfully implanted, the malware will grant operators the ability to steal sensitive data from targeted computers, allow for long-term access to internal networks and monitor government communications. While the exact number of compromised systems is currently unclear, the targets are believed to be US government officials and policy analysts specialising in Latin American affairs.

The US Department of Justice (DOJ) has previously identified Mustang Panda as a state-sponsored group funded by the China to develop spying software and penetrate foreign networks.

Meanwhile, news agency Reuters says that a spokesperson for the Chinese embassy in Washington denied the allegations, stating that China “consistently opposes and legally combats all forms of hacking activities.” The embassy dismissed the report as “false information” spread for “political purposes”.