Canadian researchers are reporting that a spy network, known as GhostNet and based mainly in China, has infiltrated computers from government offices of several countries. Reports say India, Pakistan, Portugal and Germany are among those affected.
The Munk Center says that nearly 1,300 computers had been hacked using the malware which gives hackers the ability to extract top secret information from the compromised machines. Aside from the aforementioned nations, Iran, Indonesia, Brunei, as well as non-government organizations and the media were among the targets with a total of 103 countries affected. The report claims that up to 30 percent of the infected hosts are considered high-value targets.
GhostNet presents itself as an email attachment. Once opened, it directs infected computers to download a Trojan called gh0st RAT, which in turn gives hackers to “complete, real-time” control of the computer including searching and downloading specific files and operating attached peripherals such as webcams and mics. Once a machine is infected, files can then be “mined” for contact information, which is then used to spread the malware even further via email.
According to the report the researchers the GhostNet network had penetrated several machines containing sensitive and secret information at the private offices of the Dalai Lama and other Tibetan targets. Their investigations led them to a group of servers on Hainan Island, off China. Guardian UK reports that other servers they tracked were based in China's Xinjiang Uyghur autonomous region, where intelligence units dealing with Tibetan independence groups are based.
China denies allegations that it is behind the espionage. According to Sky News, the Chinese government said in a written statement that there is “no evidence” to back up the report’s claims and dubbed it a propaganda campaign against the country. The Chinese Government was also quick to point out that the report was commissioned by the government of the the Dalai Lama.
