{"id":756,"date":"2020-02-18T18:30:01","date_gmt":"2020-02-18T17:30:01","guid":{"rendered":"https:\/\/lab52.io\/blog\/?p=756"},"modified":"2020-02-18T19:58:35","modified_gmt":"2020-02-18T18:58:35","slug":"the-role-of-china-in-the-persian-gulf-and-potential-cyberthreats","status":"publish","type":"post","link":"https:\/\/lab52.io\/blog\/the-role-of-china-in-the-persian-gulf-and-potential-cyberthreats\/","title":{"rendered":"The role of China in the Persian Gulf and potential cyberthreats:"},"content":{"rendered":"\n

<\/p>\n\n\n\n

\n\nAfter the rise of tensions between the US and Iran due to the US military operation that ended the life of the Iranian General Qasem Soleimani and the Iraqi Commander Abu Mahdi al-Muhandis ([12]), Iran carried out an attack with missiles against two US military bases located in Iraq ([13]). These events have generated a climate of uncertainty and an increase of geopolitical risk in one of the most relevant areas, the Persian Gulf. This fact does not only involve the US and Iran, furthermore it involves other actors with a high influence in the world order such as China. \n\n<\/p>\n\n\n\n

This phenomenon could provoke that China carries out certain strategies\nto keep its energy interests safeguarded in the Middle East area. During 2019, some\ntechnical traces were detected and this traces where potentially related to\ncertain APT groups presumably associated with the People’s Republic of China\n(APT10) that would be carrying out malicious campaigns against various targets\nlike critical infrastructures  organizations among others ([14]) ([15]).<\/p>\n\n\n\n

In the past, the relationship between Tehran and Beijing was based on a\ntrade agreement focused in the exchanging of crude oil and weapons ([19]). Regarding the second point, in the war between Iran and Iraq\n(1980-1988), when the targets of both actors were the oil stations and oil\nfreighters, reaching the blockade of the Strait of Hormuz, the situation began\nto be unsustainable from the point of view of the trade of crude. In order to\nreduce the tension, the USSR and the USA, agreed in 1985 to cease the sale of\nweapons. However, according to the Stockholm International Institute for Peace,\nChina was always faithful to Iran to keep the arm sales operations and\ncurrently it is still being one of the most relevant Iran\u2019s partners ([21]). <\/p>\n\n\n\n

The Chinese interests in Iran directly clashed with the long-standing\nconfrontation between the USA and Iran since the fall of Shah M. Reza Pahlavi\nand subsequently with the power of Ayatollah R. Khomeini in 1979, establishing\nthe Islamic Republic of Iran, thus Islamic Revolution ended its westernization.\nThat\u2019s why, currently the new commercial approach between the US and China comes\nwith the US imposition to try to finish within the crude oil trade with Iran.<\/p>\n\n\n\n

Consequently, china has significantly reduced its crude oil imports from\nIran since the US again imposed sanctions during November 2018 ([16]). During 2015, the Obama Administration carried out jointly with Iran,\nGermany, Great Britain, China, France and Russia, the Tehran nuclear agreement,\nat those time China significantly increased its commercial ties with Iran.\nDuring 2016, Iran and China agreed to expand bilateral ties and increase trade\nto $ 600 billion by 2025. This business planning was truncated at the time that\nthe Trump Administration withdrew from the Nuclear Pact. Chinese imports of\nIranian crude oil fell from 650,000 barrels per day to an average of 140,000\nbarrels in recent months ([16]).<\/p>\n\n\n\n

China, in response to the impossibility of\nestablishing and developing business operations with Iran, imported a total of\n76.3 million tons of crude oil from Saudi Arabia in the first 11 months of last\nyear, 53% more than in the same period of 2018 ([16]). On the other hand, Iranian oil exports fell to 14.4 million tons.\nMoreover, China has a relative neutral role in the Iran-USA conflict, Pekin is\ntrying to strength the ties with Saudi Arabia, looking to supply them specific\nmilitary material and weapons that the USA does not supply them as the CH-4 UAV\ndrones, similar to the American MQ-1 Predator ([21]).     <\/p>\n\n\n\n

China aims to balance its crude oil suppliers against the rise of instability in the Middle East. In addition, China is one of the world’s leading oil consumers, this means that its economy has an important high dependence on oil. As can be seen in the following table, China remain in the second place in the top of oil consumers after the US ([6]).<\/p>\n\n\n\n
\n Country<\/strong>\n <\/td> M. barrels per day<\/strong> <\/td>\n Share of world total<\/strong>\n <\/td><\/tr>
United States <\/td> 19.96 <\/td> 20% <\/td><\/tr>
China <\/td> 13.57 <\/td> 14% <\/td><\/tr>
India <\/td> 4.34 <\/td> 4% <\/td><\/tr>
Japan <\/td> 3.92 <\/td> 4%   <\/td><\/tr>
Russia <\/td> 3.69 <\/td> 4% <\/td><\/tr>
Saudi Arabia <\/td> 3.33 <\/td> 3% <\/td><\/tr>
Brazil <\/td> 3.03 <\/td> 3% <\/td><\/tr>
South Korea <\/td> 2.63 <\/td> 3%   <\/td><\/tr>
Germany <\/td> 2.45 <\/td> 2% <\/td><\/tr>
Canada <\/td> 2.42 <\/td> 2%   <\/td><\/tr>
Total top 10 <\/td> 59.33 <\/td> 60% <\/td><\/tr>
World total <\/td> 98.76 <\/td> <\/td><\/tr><\/tbody><\/table>\n\n\n\n

Illustration 1. Oil consumption (2018)<\/em><\/p>\n\n\n\n

Moreover, as can be seen in the following graph, China ranks fifth in the ranking of oil producing countries in the worldwide ([6]):<\/p>\n\n\n\n
\n Country<\/strong>\n <\/td>\n Million barrels per day<\/strong>\n <\/td>\n Share of world total<\/strong>\n <\/td><\/tr>
\n United States\n <\/td> 17.94 <\/td> 18% <\/td><\/tr>
\n Saudi Arabia\n <\/td> 12.42 <\/td> 12% <\/td><\/tr>
\n Russia\n <\/td> 11.40 <\/td>   11% <\/td><\/tr>
\n Canada\n <\/td>   5.38 <\/td>   5% <\/td><\/tr>
\n China\n <\/td>   4.81 <\/td>   5% <\/td><\/tr>
\n Iraq\n <\/td>   4.62 <\/td>   5% <\/td><\/tr>
\n Iran\n <\/td>   4.46 <\/td>   4% <\/td><\/tr>
\n United Arab Emirates\n <\/td>   3.79 <\/td>   4% <\/td><\/tr>
\n Brazil\n <\/td>   3.43 <\/td>   3% <\/td><\/tr>
\n Kuwait\n <\/td>   2.91 <\/td>   3% <\/td><\/tr>
\n Total top 10\n <\/td> 71.15 <\/td>   71% <\/td><\/tr>
\n World total\n <\/td>\n 100.89\n <\/td>\n  \n <\/td><\/tr><\/tbody><\/table>\n\n\n\n

Illustration 2. Origin of oil imports in China.<\/em><\/p>\n\n\n\n

The graph shows us that a significant part of China’s\noil suppliers comes from politically unstable regions and must be transported\nthrough narrow and sea lanes disputed with other States with high military competence.\nIt is relevant for China to keep these logistic access roads insured to keep\nits development and economic expansion.<\/p>\n\n\n\n

In addition, this dependence on foreign energy\nresources is likely to increase considerably. It is expected that in 2040 about\n80% of the oil consumed by China will come from other States ([7]). For this reason, China is interested in investigating and controlling\nthe instability in the Middle East, since a significant percentage of its oil\nimports come from Iran, Iraq, Saudi Arabia, Oman and Kuwait, all within the\nPersian Gulf.<\/p>\n\n\n\n

To maintain this flow of energy resources, China and the Saudi King Salman signed an oil trade agreement for $ 65 billion in 2017 ([8]). In addition, the OBOR route, the main international route to carry out the transport of goods, is increasingly getting consolidated and more functional.<\/p>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n

Illustration 3. OBOR route for the oil trade.<\/em><\/p>\n\n\n\n

Currently, all imports from Iran and Saudi Arabia are\nintroduced into China through the Malacca Canal, near the South China Sea.<\/p>\n\n\n\n

Probably, the presence and influence of China in the\nMiddle East is not going to be militarily. However, it constantly looks for\ndiplomatic and business opportunities to acquire organizations from the energy\nsector in order to accomplish their future energy demands ([9]). <\/p>\n\n\n\n

These business and diplomatic opportunities could be\npreceded by cyber espionage operations with the purpose of acquiring advantages\nin the sector. Organizations in the energy sector have important confidential\ninformation that certain governments may be highly interested in. The energy\norganizations which are located in certain Middle East locations of interest of\nChina would be a potential target of cyberespionage. <\/p>\n\n\n\n

CAMPAIGN AGAINST\nTHE USA ADMINISTRATION AND THE ENERGY SECTOR<\/p>\n\n\n\n

During 2019, a malicious campaign was executed against\nUS public sector organizations. This campaign, due to the macros used, is\nlikely to be attributed to APT10, a group allegedly linked to the Ministry of\nSecurity and Intelligence of China ([1]) ([18]). The malware\nused was “Lookback.” The spear phishing carried out an impersonation\nof GEC (Global Energy Certification) to offer certain certification courses ([2]). Topic which would be highly interesting for critical infrastructure or\nenergy professionals. <\/p>\n\n\n\n

Several spear phishing emails came from the following\nmalicious domain: globalenergycertification[.]Net. The same domain was used in\nprevious malicious campaigns. The hostile actor tries to impersonate a\nlicensing agency that is linked to the public sector\nglobalenergycertification[.]Org. In the body of the email, topics are included\nto impersonate the \u201cGlobal Energy Certification\u201d (GEC). The word file attached\nin the email has the macros that once is downloaded and executed infects the systems\nof the victim ([2]).<\/p>\n\n\n\n

During the first stages of the infection it was\npossible to identify that the attackers carried out a reconnaissance phase\nthrough SMB scans on the port 445. This activity was carried out two weeks before\nto the reception of spear phishing.<\/p>\n\n\n\n

The delivery was a fake invitation to carry out the exam to get the Global Energy Certification ([2]):<\/p>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n

Illustration 4. Spear phishing email body<\/em><\/p>\n\n\n\n

The domain globalenergycertification[.]Net resolves to this IP 79.141.169[.]3. In the following chart there are the domains and IPs which were hosted with their respective date and impersonated entity records:<\/p>\n\n\n\n
\n IP<\/strong>\n <\/td>\n Domain<\/strong>\n <\/td>\n Dates Registered<\/strong>\n <\/td>\n Impersonated entity<\/strong>\n <\/td><\/tr>
79.141.169 [.] 3 <\/td>\n globalenergycertification [.] net\n <\/td>\n August 1 \u2013 September 19, 2019\n <\/td>\n Global Energy Certification (“GEC”)\n <\/td><\/tr>
\n 103.253.41\n [.] 75\n <\/td>\n globalenergycertification [.] net\n <\/td>\n June 12 \u2013 July 30, 2019\n <\/td>\n Global Energy Certification (“GEC”)\n <\/td><\/tr>
\n 79.141.168\n [.] 137\n <\/td>\n nceess [.] com\n <\/td>\n June 24 \u2013 September 19, 2019\n <\/td>\n National Council of Examiners for\n engineering and Survey\n <\/td><\/tr>
\n 103.253.41\n [.] 75\n <\/td>\n nceess [.] com\n <\/td>\n May 29 \u2013 June 19, 2019\n <\/td>\n National Council of Examiners for\n engineering and Survey\n <\/td><\/tr><\/tbody><\/table>\n\n\n\n

It has been identified that Lookback samples use the\nsame C&C 103.253.41 [.] 45.<\/p>\n\n\n\n

In the MISP (Malware Information Sharing Platform) is showed the IPs shared and the domain associated to both malicious campaigns:  <\/p>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n

Illustration 5. MISP graphic<\/em><\/p>\n\n\n\n

CONCLUSIONS<\/p>\n\n\n\n

A rise of malicious campaigns against the critical\ninfrastructure or even energy sector has been detected. This sector can be\ndecisive for the progress of large economies such as China, the US and the main\nsuppliers of the Middle East energy sector. <\/p>\n\n\n\n

The instability in the Middle East\u2019s energy sector and\nthe protectionist policies of certain governments are increasing the\ngeopolitical risk and could increase the China’s concern about its own energy\nsupply.<\/p>\n\n\n\n

The malicious campaign showed before was carried out\nin 2019. However, the geopolitical tension is getting higher in the Middle\nEast, so it would be possible that more malicious campaigns will come to\nacquire confidential information for spying purposes.<\/p>\n\n\n\n

REFERENCES<\/p>\n\n\n\n

[1]\nProofpoint. Lookback and United States. https:\/\/www.proofpoint.com\/us\/threat-insight\/post\/lookback-forges-ahead-continued-targeting-united-states-utilities-sector-reveals<\/a> <\/p>\n\n\n\n

[2]\nProofpoint. Lookback malware. https:\/\/www.proofpoint.com\/us\/threat-insight\/post\/lookback-malware-targets-united-states-utilities-sector-phishing-attacks<\/a>\n<\/p>\n\n\n\n

[3]\nSchroders. 2019 Global market prespective. https:\/\/www.schroders.com\/en\/sysglobalassets\/digital\/insights\/2019\/pdfs\/q3-2019-global-market-perspective-261959.pdf<\/a>\n<\/p>\n\n\n\n

[4] NBR.\nSecuring belt and road 2019. https:\/\/www.nbr.org\/wp\ncontent \/ uploads \/ pdfs \/ publications \/\nsr80_securing_the_belt_and_road_sep2019.pdf<\/a> <\/p>\n\n\n\n

[5] CSIS.\nChina grand strategy. https:\/\/csis-prod.s3.amazonaws.com\/s3fs-public\/publication\/190807_China_Grand_Strategy_Final_Full.pdf<\/a>\n<\/p>\n\n\n\n

[6] EIA. https:\/\/www.eia.gov\/tools\/faqs\/faq.php?id=709&t=6<\/a>\n<\/p>\n\n\n\n

[7] World\nto Export http:\/\/www.worldstopexports.com\/top-15-crude-oil-suppliers-to-china\/<\/a>\n<\/p>\n\n\n\n

[8]\nEnglish Al-Arabiya. China geo-economic interest. https:\/\/english.alarabiya.net\/en\/views\/news\/middle-east\/2018\/08\/29\/China-s-geo-economic-interests-and-Middle-East-energy-industry.html<\/a>\n<\/p>\n\n\n\n

[9]\nWashington Institute. China and the Middle East. https:\/\/www.washingtoninstitute.org\/policy-analysis\/view\/chinas-middle-east-policy-speak-softly-and-wave-a-large-purse<\/a> <\/p>\n\n\n\n

[10]\nScrip. Paper Information ID 83914 http:\/\/www.scirp.org\/journal\/PaperInformation.aspx?PaperID=83914<\/a>\n<\/p>\n\n\n\n

[11] China\nPower CSIS. https:\/\/chinapower.csis.org\/energy-footprint\/<\/a>\n<\/p>\n\n\n\n

[12] BBC. https:\/\/www.bbc.com\/news\/world-middle-east-50995792<\/a>\n<\/p>\n\n\n\n

[13] NBC\nnews. https:\/\/www.nbcnews.com\/news\/world\/u-s-base-iraq-comes-under-attack-missiles-iran-claims-n1112171<\/a>\n<\/p>\n\n\n\n

[14]Energy\nGovernment. https:\/\/www.energy.gov\/articles\/department-energy-statement-chinese-hacking-global-managed-service-providers<\/a>\n<\/p>\n\n\n\n

[15]\nCyberscoop. https:\/\/www.cyberscoop.com\/chinese-linked-apt10-has-been-active-in-the-philippines-researchers-say\/<\/a>\n<\/p>\n\n\n\n

[16] Japan\nTimes. https:\/\/www.japantimes.co.jp\/news\/2020\/01\/18\/asia-pacific\/us-iran-tensions-china-economy\/<\/a>\n<\/p>\n\n\n\n

[17]\nMiddle East Monitor. https:\/\/www.middleeastmonitor.com\/20200115-is-the-strait-of-hormuz-the-key-to-iran-asserting-its-dominance\/<\/a>\n<\/p>\n\n\n\n

[18]\nLifars https:\/\/lifars.com\/2019\/08\/apt10-targeting-american-utility-companies\/<\/a>\n<\/p>\n\n\n\n

[19] South\nChina Morning Post https:\/\/www.scmp.com\/news\/china\/military\/article\/3045253\/china-and-iran-relationship-built-trade-weapons-and-oil<\/a>\n<\/p>\n\n\n\n

[20]\nBrown. https:\/\/www.brown.edu\/Research\/Understanding_the_Iran_Contra_Affair\/i-thebeginning.php<\/a>    <\/p>\n\n\n\n

[21] SIPRI\nhttps:\/\/www.sipri.org<\/a>\n<\/p>\n\n\n\n

[22] Atlantic Council. https:\/\/www.atlanticcouncil.org\/blogs\/menasource\/chinas-persian-gulf-strategy-keep-tehran-and-riyadh-content\/<\/a> <\/p>\n","protected":false},"excerpt":{"rendered":"

After the rise of tensions between the US and Iran due to the US military operation that ended the life of the Iranian General Qasem Soleimani and the Iraqi Commander Abu Mahdi al-Muhandis ([12]), Iran carried out an attack with missiles against two US military bases located in Iraq ([13]). These events have generated a […]<\/p>\n","protected":false},"author":6,"featured_media":778,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_genesis_hide_title":false,"_genesis_hide_breadcrumbs":false,"_genesis_hide_singular_image":false,"_genesis_hide_footer_widgets":false,"_genesis_custom_body_class":"","_genesis_custom_post_class":"","_genesis_layout":"","footnotes":""},"categories":[1],"tags":[4,23,22,25,24],"class_list":{"0":"post-756","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-uncategorised","8":"tag-apt","9":"tag-apt10","10":"tag-china","11":"tag-critical-infrastructure","12":"tag-energy","13":"entry"},"featured_image_src":"https:\/\/lab52.io\/blog\/wp-content\/uploads\/2020\/02\/pexels-photo-1716008-600x400.jpeg","featured_image_src_square":"https:\/\/lab52.io\/blog\/wp-content\/uploads\/2020\/02\/pexels-photo-1716008-600x600.jpeg","author_info":{"display_name":"Dex","author_link":"https:\/\/lab52.io\/blog\/author\/dex\/"},"_links":{"self":[{"href":"https:\/\/lab52.io\/blog\/wp-json\/wp\/v2\/posts\/756"}],"collection":[{"href":"https:\/\/lab52.io\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lab52.io\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lab52.io\/blog\/wp-json\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"https:\/\/lab52.io\/blog\/wp-json\/wp\/v2\/comments?post=756"}],"version-history":[{"count":23,"href":"https:\/\/lab52.io\/blog\/wp-json\/wp\/v2\/posts\/756\/revisions"}],"predecessor-version":[{"id":784,"href":"https:\/\/lab52.io\/blog\/wp-json\/wp\/v2\/posts\/756\/revisions\/784"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/lab52.io\/blog\/wp-json\/wp\/v2\/media\/778"}],"wp:attachment":[{"href":"https:\/\/lab52.io\/blog\/wp-json\/wp\/v2\/media?parent=756"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lab52.io\/blog\/wp-json\/wp\/v2\/categories?post=756"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lab52.io\/blog\/wp-json\/wp\/v2\/tags?post=756"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}