Chimera, a Chinese-linked hacker group, infiltrated the network of the Dutch semiconductor giant NXP and had access for over two years from late 2017 to the beginning of 2020, reports NRC. During this period, the notorious hackers reportedly stole intellectual property, including chip designs — however, the full extent of the theft is yet to be disclosed. NXP is the largest chipmaker in Europe, and the scale and extent of the reported attack is shocking.
According to the report, the breach remained undetected for roughly two and a half years while the hackers lurked in the company's network — the breach was only discovered because a similar attack occurred on the Dutch airline Transavia, a subsidiary of KLM. Hackers accessed Transavia's reservation systems in September 2019. An investigation of the Transavia hack uncovered communications with NXP IPs, which led to the discovery of the NXP hack. The attack bears all of the hallmarks of the Chimera hacking group, including the use of its ChimeRAR hacker tool.
To break into NXP, the hackers initially used credentials from previous data leaks on platforms like LinkedIn or Facebook and then used brute force attacks to guess the passwords. They also bypassed double authentication measures by altering phone numbers. The hackers were patient, only checking for new data to steal every few weeks, and then snuck the data out using encrypted files uploaded to online cloud storage services, like Microsoft's OneDrive, Dropbox, and Google Drive.
