© GETTY IMAGES/AFP/MADDIE MEYER
Chinese government-linked hackers targeted biotech company Moderna, a US-based coronavirus vaccine research developer, in a bid to steal data, according to a US security official tracking Chinese hacking.
China, on Friday, rejected the accusation that hackers linked to it had targeted Moderna.
Last week, the US justice department made public an indictment of two Chinese nationals accused of spying on the US, including three unnamed US-based targets involved in medical research to fight the coronavirus.
The indictment said the Chinese hackers "conducted reconnaissance" against the computer network of a Massachusetts biotech firm known to be working on a coronavirus vaccine in January.
Moderna, which is based in Massachusetts and announced its Covid-19 vaccine candidate in January, confirmed that the company had been in contact with the FBI and was made aware of the suspected "information reconnaissance activities" by the hacking group mentioned in last week's indictment.
Reconnaissance activities can include a range of actions, including probing public websites for vulnerabilities to scouting out important accounts after entering a network, cyber-security experts say.
"Moderna remains highly vigilant to potential cyber-security threats, maintaining an internal team, external support services and good working relationships with outside authorities to continuously assess threats and protect our valuable information," said company spokesperson Ray Jordan, declining to provide further detail.
The US security official, who spoke on condition of anonymity, did not provide further details. The FBI and the US department of health and human services declined to disclose the identities of companies targeted by Chinese hackers.
Moderna's vaccine candidate is one of the earliest and biggest bets by the Trump administration to fight the pandemic. The federal government is supporting development of the company's vaccine with nearly half a billion dollars and helping Moderna launch an imminent clinical trial of up to 30,000 people.
China is also racing to develop a vaccine, bringing together its state, military and private sectors to combat a disease that has killed more than 660,000 people worldwide.
'Baseless'
The July 7 indictment alleges that the two Chinese hackers, identified as Li Xiaoyu and Dong Jiazhi, conducted a decade-long hacking spree that most recently included the targeting of Covid-19 medical research groups.
Prosecutors said Li and Dong acted as contractors for China's ministry of state security, a state intelligence agency. Messages left with several accounts registered under Li's digital alias, oro0lxy, were not returned. Contact details for Dong were not available.
China has consistently denied any role in hacking and its foreign ministry spokesperson in Beijing, Wang Wenbin, rejected as "baseless" the accusation that hackers linked to the government had targeted Moderna.
China leads the world in the development of a coronavirus vaccine and it is more worried that other countries using hackers to steal its technology, he said. "We absolutely do not nor need to engage in theft to achieve this leading position."
The two other unidentified medical research companies mentioned in the justice department indictment are described as biotech companies based in California and Maryland. Prosecutors said the hackers "searched for vulnerabilities" and "conducted reconnaissance" against them.
The court filing describes the California firm as working on antiviral drug research and suggested the Maryland company had publicly announced efforts to develop a vaccine in January. Two companies that could match those descriptions: Gilead Sciences and Novavax.
Gilead spokesperson Chris Ridley said the firm does not comment on cyber-security matters. Novavax would not comment on specific cyber-security activities but said: "Our cyber-security team has been alerted to the alleged foreign threats identified in the news."
A security consultant familiar with multiple hacking investigations involving premier biotech firms over the past year said Chinese groups believed to be broadly associated with China's ministry of state security are one of the primary forces targeting Covid-19 research, globally. This matches the description of the indicted hackers, as ministry contractors.
Comment: See also: