Ask Lemmy

I manage the IT for a SMB in the non-profit mental health space, and am connected through another role to our state’s cybersecurity fusion center. My small, insignificant network has scanning attempts run on it a few thousand times a day. Several hundred times a day we will log attacks from various vectors. Looking at the stats every month, going back a decade, the source of all of these is: #1) Russia, #2) China. Every. Time. We present a fat ransomware target, but have no IP to steal, so why the interest? A couple of reasons, courtesy of the fusion center and the local FBI office: first, supply chain attacks: we are partnered with larger medical groups, insurance companies, the state government, and research universities, and using trusted connections to get into those upstream entities is sometimes easier than attacking the front door. I have a small security budget comparatively. Second: botnets/zombies: taking over systems from within the US and making your traffic domestic, or even local to your target helps obfuscate the source of the attack, and ultimately why everyone should care. Not just about China, but about security in general - unpatched home PCs have been used to host and distribute malware, spam and even CP. I certainly wouldn’t want that on my home network. Even if someone didn’t care about that, Americans can be trusted to fall back on: “they’re taking something of yours” - they’re using your bandwidth and you’re paying for it. I believe the Chinese citizens just want the same things American, German, Bulgarian, and East Elbonian citizens want - to live life and be happy (in our parlance; “Life, liberty, and the pursuit of happiness”). But the Chinese government however, has a 100-year plan to be the sole economic power in the world, and the way they’re trying to get there isn’t playing nicely in the sandbox.