Pierluigi Paganini April 04, 2019

The German chemicals giant Bayer confirmed that of a cyber attack, it confirmed the incident but clarified that no data has been stolen.

The chemicals giant Bayer is the last victims of a cyber attack, it confirmed the incident, but pointed out the hackers haven’t stolen any data.

According to the company, at the beginning of 2018, it detected an intrusion that linked to Winnti threat actors, a group of Chinese APTs belonging to the Beijing intelligence apparatus, Groups under the Winnti umbrella are tracked as PassCV, APT17, Axiom, LEAD, BARIUM, Wicked Panda, and GREF.

“Bayer had found infectious software from a hacker group known as Winnti in early 2018. The company’s Cyber Defense Center had managed to restore and clear the affected systems, Bayer said in a statement.” reported the website Firstpost.com.

“There is no evidence of data theft,” the statement said, though a spokesman added that the overall damage is still being assessed.

The Winnti group was first spotted by Kaspersky in 2013, according to the researchers the gang has been active since 2007.

The gang is financially-motivated and was mostly involved in cyber espionage campaigns.  The hackers were known for targeting companies in the online gaming industry, the majority of the victims is located in Southeast Asia.

The activity of this specific APT group against Bayer was first spotted in early 2018, according to the experts the hackers remained inside the company networks until late last month.

Bayer reported the incident to the local authorities and has removed the threat from the affected systems.

Bayer said that “in close collaboration with” private cyber security organisation DCSO and police in North Rhine-Westphalia state it had “identified, analysed and cleaned up the affected systems.”

At the time of writing the police had declined to comment because the investigation is still ongoing.

“Andreas Rohr of the DCSO — set up by German companies as a joint cyber defence centre — said that given the targets so far chosen by Winnti, “we can assume that there is a very targeted tasking by the Chinese state,” although definite proof was impossible.” reads the AFP press.

Attacks associated with Winnti APT hit three smaller German firms since the beginning of 2019, local media reported.

In 2016, the hackers also hit German heavy industry giant ThyssenKrupp to steal company secrets.

The hackers launched a “massive cyber attack” against the divisions dealing with orders planning of industrial plants, the conglomerate’s Industrial Solutions, and Steel Europe business divisions.

Pierluigi Paganini

(SecurityAffairs – Winnti APT, hacking

[adrotate banner=”5″]

[adrotate banner=”13″]