The US Department of Justice (USDOJ) has indicted a Chinese national for wire fraud and aggravated identity theft after he attempted to hack data from multiple US aviation agencies. Song Wu, a 39-year-old engineer employed by Chinese state-owned firm Aviation Industry Corporation of China (AVIC), used email phishing tactics to obtain restricted software related to aerospace engineering and computational fluid dynamics.

US indicts Chinese national for aerospace phishing campaign

According to a release from the US Attorney’s Office, Northern District of Georgia, Song is alleged to have executed a multi-year “spear phishing” campaign to trick employees at several agencies and institutions – including NASA, the FAA, US Air Force, Navy and Army, and major research and private sector firms specializing in aerospace – into divulging source code or software.

nasa sls block 1b

Photo: NASA

Song would reach out to these individuals by email under the pretext of being a colleague, associate, or member of the research community, in order to obtain “specialized restricted or proprietary software used for aerospace engineering and computational fluid dynamics.” The software has both industrial and military applications, including the development of “advanced tactical missiles” and weapon design. US Attorney Ryan K. Buchanan said,

“Efforts to obtain our nation’s valuable research software pose a grave threat to our national security. However, this indictment demonstrates that borders are not barriers to prosecuting bad actors who threaten our national security.”

The campaign is said to have started in 2017 and continued until 2021. One of the programs Song attempted to gain access to is ‘CBAero’, which developer NASA says is used to predict “conceptual aero-thermodynamic environments of aerospace configurations.” In one email, Song casually emailed the following to an employee he believed could access CBAero:

“Morning [Victim 8], I sent an email to Alicia for a copy of CBAERO software, but got no response yet. Are you available to help? Please let me know.”

While engaging in his extensive phishing campaign, Song was employed by Chinese company AVIC, one of the world’s largest defense contractors and a manufacturer of military aircraft used by the People’s Liberation Army (PLA). He now faces 14 counts of wire fraud – each count carrying a prison term of up to 20 years – and another 14 counts of aggravated identity theft.

What is spear phishing?

As per cybersecurity firm Kaspersky, the term spear phishing is defined as “highly personalized” phishing strategies that targets specific individuals within an organization. This usually involves some degree of research on the intended victim before the perpetrator impersonates someone the target knows or might know, such as an indirect industry associate.

Backside of Philadelphia International Airport ATC tower.

Photo: Philadelphia International Airport

The US has faced an uptick in cybersecurity threats in recent years, particularly in the aerospace industry. In another case from a couple of years ago, a Chinese national was sentenced to 20 years in prison after he was caught spying on multiple aerospace companies. This included attempts to obtain information on advanced composite materials from GE Aviation via the use of sophisticated front companies and false identities.

To combat the growing threat of foreign cybersecurity intrusions, the US has set up its multi-agency Disruptive Technology Strike Force, which aims to stop “the transfer of sensitive, cutting-edge technologies to Iran, China, and Russia.”

Leave a Reply

Your email address will not be published. Required fields are marked *