Hackers linked to the Chinese government stole at least $20 million in U.S. Covid reliefbenefits, including Small Business Administration loans and unemployment insurance funds in over a dozen states, according to the Secret Service.
The theft of taxpayer finds by the Chengdu-based hacking group known as APT41 is the first instance ofpandemic fraud tied to foreign, state-sponsored cybercriminals that the U.S. government has acknowledged publicly, but may just be the tip of the iceberg, according to U.S. law enforcement o8iciab and cybersecurity experts.
The officials and experts, rrost speaking on the condition of anonyrriity because of the sensitivity of the subject matter, say other federal investigations ofpandemic fraud also seem to point back to foreign state-af0liated hackers.
“It would be crazy to think this group didn't target all 50 states,” said Roy Dotson, national pandemic fraud recovery coordinator for the Secret Service, who also acts as a liaison to other federal agencies probing Covid fraud.
The Secret Service declined to confirm the scope of other investigations, saying there are more than 1,000 ongoing investigations involving transnational and domestic crirninalactors defrauding public benehts programs, and APT41 is “a notable player.”
And whether the Chinese government directed APT41 to loot U.S. taxpayer funds or simply looked the other way, multiple current and former U.S. official say, the thefl itself is a troubling developrrient that raises the stakes. One senior Justice Department o8icial called it “dangerous” and said it had serious national security irrglications.
“I've never seen them target government money before,” said John Hultquist, the head of intelligence analysis at the cybersecurity firm Mandiant. ‘It would be an escalation”
The Chinese Embassy in Washington did not respond to requests for corriment.
‘The horse is out of the barn’
As soon as state governrrients began disbursing Covid imemployrrient funds in 2020, cybercriminab began to siphon off a s cant percentage.
The Labor Department Office of Inspector General has reported an improper payment rate of roughly 20% for the
$872.5 billion iri federal pandemic unemployment funds, though the true cost of the fraud is likely higher, administration official from multiple agencies say.
In-depth analysis of four states showed 42.4% ofpandemic benefits were paid improperly in the first six months, the department's watchdog reported to Congress last week.
A Heritage Foundation analysis of Labor Department data estirriated excess unemployment benefits payments of more than $350 billion from April 2020 to May 2021.
‘Whether it's 350, 400 or 500 billion, at this point, the horse is out of the barn,” said Linda Miller, the former deputy executive director of the Pandemic Response Accountability Committee, the federal governrrient's Covid relief fraud watchdog.
By the time Covid relieffimds appeared as a target of opportunity in 2020, APT41, which emerged rrere than a decade ago, had already becorrie the ‘Workhorse” of cyberespionage operations that benefit the Chinese government, according to cyber experts and current and former official from multiple agencies. The Secret Service said in a
statement that it considers APT41 a “Chinese state-sponsored, cyberthreat group that is highly adept at conducting espionage missions and financial crimes for personal garry”
Ambassador Nathaniel Fick, the head of the State Department's Bureau of Cyberspace and Digital Policy, said cyberespionage is a long-time Chinese national priority aimed at strengthening its geopolitical position.
