Skip to Content

Out-of-Work Chinese Government Hackers May Be Behind Sophisticated Ransomware Attacks

The downside of Obama’s effort to rein in Chinese industrial espionage could be advanced ransomware attacks on U.S. companies.
March 15, 2016

Malicious software that holds data hostage using encryption has already proved devastatingly effective and very lucrative for criminals. Now some of the Internet’s most sophisticated criminals are getting in on the act, targeting corporations as a quick path to profit.

Reuters reports that four leading security firms have seen ransomware used against U.S. companies by people who appear to be associated with hacking groups that work at the behest of China’s government. Such groups usually target corporate secrets in sophisticated operations that experts say are state-sponsored economic espionage.

Victims of this new high-end ransomware include transportation and technology companies, according to Reuters. Their report doesn’t say how big a ransom the attackers asked for, but groups with enough skill might be able to hold very valuable data hostage and demand large payouts.

By contrast, ransomware is usually spread as widely as possible by criminals who demand modest sums for the safe return of data, typically around $500, because they want to collect from individuals as well as companies.

Why hackers who usually work for a superpower might start using a small-time criminal tactic is unclear. One reason is that deploying ransomware might be an easy way to extract some extra money once a conventional espionage job is over.

A more intriguing possibility is that these might be lean times for China’s industrial espionage hackers. Late last year President Obama and his Chinese counterpart Xi Jinping agreed not to support theft of intellectual property, and to assist each other in investigating cases that did occur. The deal was seen as a breakthrough after years of U.S. complaints about computer incursions from China.

The Cryptolocker ransomware message is not a welcome sight.

That agreement may have caused China to cut back on its sponsorship of hackers, driving them to find alternative forms of income, the security companies reporting the new malware campaigns told Reuters. If that theory is correct, companies might expect to see less of their data headed to China, but more of it locked up by malware with a ransom note attached.

Either way, we can expect ransomware to become more common. The FBI’s Internet Crime Complaint Center said on March 10 that it was notified of 2,453 ransomware infections by victims in 2015, who collectively paid $24.1 million to get their data back. The true figure for the U.S. is likely to be much higher, and the FBI expects the problem to grow.

(Read more: Reuters, Wall Street Journal, “Holding Data Hostage: The Perfect Internet Crime?” “Waiting for a Drop in Corporate Hacks After U.S.-China Deal,” “Hospital Forced Back to Pre-Computer Era Shows the Power of Ransomware”)

Keep Reading

Most Popular

A Roomba recorded a woman on the toilet. How did screenshots end up on Facebook?

Robot vacuum companies say your images are safe, but a sprawling global supply chain for data from our devices creates risk.

A startup says it’s begun releasing particles into the atmosphere, in an effort to tweak the climate

Make Sunsets is already attempting to earn revenue for geoengineering, a move likely to provoke widespread criticism.

10 Breakthrough Technologies 2023

Every year, we pick the 10 technologies that matter the most right now. We look for advances that will have a big impact on our lives and break down why they matter.

These exclusive satellite images show that Saudi Arabia’s sci-fi megacity is well underway

Weirdly, any recent work on The Line doesn’t show up on Google Maps. But we got the images anyway.

Stay connected

Illustration by Rose Wong

Get the latest updates from
MIT Technology Review

Discover special offers, top stories, upcoming events, and more.

Thank you for submitting your email!

Explore more newsletters

It looks like something went wrong.

We’re having trouble saving your preferences. Try refreshing this page and updating them one more time. If you continue to get this message, reach out to us at with a list of newsletters you’d like to receive.