Hackers spent 2+ years looting secrets of chipmaker NXP before being detected

A prolific espionage hacking group with ties to China spent over two years looting the corporate network of NXP, the Netherlands-based chipmaker whose silicon powers security-sensitive components found in smartphones, smartcards, and electric vehicles, a news outlet has reported.

The intrusion, by a group tracked under names including "Chimera" and "G0114," lasted from late 2017 to the beginning of 2020, according to Netherlands national news outlet NRC Handelsblad, which cited “several sources” familiar with the incident. During that time, the threat actors periodically accessed employee mailboxes and network drives in search of chip designs and other NXP intellectual property. The breach wasn’t uncovered until Chimera intruders were detected in a separate company network that connected to compromised NXP systems on several occasions. Details of the breach remained a closely guarded secret until now.

No material damage

NRC cited a report published (and later deleted) by security firm Fox-IT, titled Abusing Cloud Services to Fly Under the Radar. It documented Chimera using cloud services from companies including Microsoft and Dropbox to receive data stolen from the networks of semiconductor makers, including one in Europe that was hit in “early Q4 2017.” Some of the intrusions lasted as long as three years before coming to light. NRC said the unidentified victim was NXP.

“Once nested on a first computer—patient zero—the spies gradually expand their access rights, erase their tracks in between and secretly sneak to the protected parts of the network,” NRC reporters wrote in an English translation. “They try to secrete the sensitive data they find there in encrypted archive files via cloud storage services such as Microsoft OneDrive. According to the log files that Fox-IT finds, the hackers come every few weeks to see whether interesting new data can be found at NXP and whether more user accounts and parts of the network can be hacked.”

NXP did not alert customers or shareholders to the intrusion, other than a brief reference in a 2019 annual report. It read:

We have, from time to time, experienced cyber-attacks attempting to obtain access to our computer systems and networks. Such incidents, whether or not successful, could result in the misappropriation of our proprietary information and technology, the compromise of personal and confidential information of our employees, customers, or suppliers, or interrupt our business. For instance, in January 2020, we became aware of a compromise of certain of our systems. We are taking steps to identify the malicious activity and are implementing remedial measures to increase the security of our systems and networks to respond to evolving threats and new information. As of the date of this filing, we do not believe that this IT system compromise has resulted in a material adverse effect on our business or any material damage to us. However, the investigation is ongoing, and we are continuing to evaluate the amount and type of data compromised. There can be no assurance that this or any other breach or incident will not have a material impact on our operations and financial results in the future.

“A big deal”

NXP is Europe’s second-biggest semiconductor company behind ASML and the world’s 18th biggest chipmaker by market capitalization. Its chips are used in iPhones and Apple watches to support advanced near-field communications security mechanisms such as tag originality, tamper detection, and authentication for Apple Pay. NXP also provides chips for the MIFARE card used by transit companies, FIDO-compliant security keys, and tools for relaying data inside the networks of electric vehicles.

Some security researchers said it was surprising that NXP officials didn’t inform customers of the two-year intrusion by threat actors, often abbreviated as TAs.

“NXP chips are in a lot of products,” Jake Williams, a former hacker for the National Security Agency, wrote on Mastodon. “It's likely the TA knows of specific flaws reported to NXP that can be leveraged to exploit devices the chips are embedded in, and that's assuming they didn't implement backdoors themselves. Over 2.5 years (at least), that's not unrealistic.”

A separate researcher who has published research in the past documenting a successful hack on a widely used product containing NXP chips voiced similar surprise.

“If a Chinese threat actor group gets source code or hardware designs of a chip manufacturer, these kinds of groups can use the source code even if the source code isn’t very well commented and documented,” the researcher, who asked not to be identified, said in an interview. “For me, [the intrusion] is a big deal. I was surprised NXP didn’t communicate with its customers.”

In an email, an NXP representative said the NRC report “is very dated as it was addressed back in 2019. As stated in our 2019 Annual Report, we became aware of a compromise of certain IT systems, and after a thorough investigation we determined that this incident did not result in a material adverse effect on our business. At NXP, we take the security of data very seriously. We learned from this experience and prioritize continually strengthening our IT systems to protect against ever-evolving cybersecurity threats.”

Chimera has extensive experience stealing data from a wide range of companies. The threat actor uses a variety of means to compromise its victims. In the campaign that hit NXP, hackers often leveraged account information revealed in previous data breaches of sites such as LinkedIn or Facebook. The data allowed Chimera to guess the passwords that employees used to access VPN accounts. Team members were able to bypass multi-factor authentication by changing telephone numbers associated with the accounts.

Security firm Cycraft documented one two-year hacking spree that targeted semiconductor makers with operations in Taiwan, where NXP happens to have research and development facilities. An attack on one of the unnamed victims compromised 10 endpoints and another compromised 24 endpoints.

“The main objective of these attacks appeared to be stealing intelligence, specifically documents about IC chips, software development kits (SDKs), IC designs, source code, etc.,” Cycraft researchers wrote. “If such documents are successfully stolen, the impact can be devastating.”