US sanctions Chinese tech firm over critical infrastructure cyberattacks
The US has designated Chinese cybersecurity company Sichuan Silence and one of its employees for allegedly compromising thousands of firewalls at critical infrastructure companies in an April 2020 cyberattack, the Treasury Department announced on 10 December.
The sanctions target Sichuan Silence Information Technology Company and security researcher Guan Tianfeng for allegedly deploying malware to approximately 81,000 firewalls owned by thousands of businesses worldwide, including 23,000 in the United States, using a previously unknown vulnerability.
‘Today’s action underscores our commitment to exposing these malicious cyber activities—many of which pose significant risk to our communities and our citizens—and to holding the actors behind them accountable,’ said Acting Treasury Under Secretary Bradley Smith.
The Department of Justice unsealed an indictment against Guan while the State Department offered a $10 million reward for information about him or Sichuan Silence, which Treasury described as a contractor whose ‘core clients’ are Chinese intelligence services.
Among the 36 US critical infrastructure targets was an energy company conducting drilling operations, where a successful attack ‘could have caused oil rigs to malfunction potentially causing a significant loss in human life,’ the Treasury statement said.
The sanctions block all US-based property of the designated persons and prohibit Americans from transacting with them.
