U.S. v. Wu et al. (Equifax PLA Unit 54th Research Institute)
Key Facts
- Legal Status: FUGITIVE in U.S. District Court for the Northern District of Georgia.
- Primary Target Sector: Financial Services, Consumer Credit.
- Documented Financial Loss: $1.4 billion.
- 3 verified MITRE ATT&CK techniques substantiated with verbatim court excerpts.
Incident Overview
Four military officers with the Chinese People's Liberation Army (PLA) 54th Research Institute charged with hacking into Equifax networks, stealing trade secrets, and exfiltrating personally identifiable information (PII) of roughly 147 million American citizens.
Root Cause & Infiltration Vector
Remote code execution via an unpatched Apache Struts vulnerability (CVE-2017-5638) on Equifax's public online dispute portal, which remained vulnerable for 66 days despite the release of a security patch.
Operational Impact & Financial Blast Radius
Compromised the sensitive personally identifiable information (PII) of approximately 147 million Americans, including names, Social Security numbers, dates of birth, and driver's license numbers. Equifax spent over $1.4 billion on remediation, infrastructure overhauls, and federal class-action settlements.
Executive Risk Checklist
- 1. Are 100% of external and administrative access portals protected by phishing-resistant MFA?
- 2. Is network microsegmentation enforced between user workstations and core database enclaves?
- 3. Have immutable offline backups and incident escalation procedures been validated within 90 days?
Incident Execution & Kill-Chain Lifecycle
Sequential reconstruction of intrusion stages from initial infiltration to resolution.
Chinese PLA military intelligence hackers exploited CVE-2017-5638 by sending malicious HTTP requests with crafted Content-Type headers, executing commands with web server privileges.
Operatives ran approximately 9,000 internal database queries to locate consumer credit data, extracting unencrypted credentials stored in plaintext configuration files.
Defendants established encrypted communications through proxy servers in Germany and Switzerland and systematically purged server access logs daily to conceal their presence.
Stolen records were split into compressed archives and exfiltrated to overseas staging servers over 76 separate intrusion days.
Standard of Care Remediation & Hardening
Empirical engineering takeaways and preventative controls derived from this incident.
Procedural & Incident Timeline
Federal grand jury returns nine-count indictment against four Chinese PLA military intelligence hackers.
Attorney General William Barr publicly announces the unsealing of charges against members of the 54th Research Institute.
Substantiated MITRE ATT&CK Techniques
| Technique ID | Technique Name & Tactic | Primary Source Evidence Excerpt | Locator | Verification |
|---|---|---|---|---|
| T1190 | Exploit Public-Facing Application Initial Access | "The conspirators exploited a known vulnerability in the Apache Struts Web Framework (CVE-2017-5638) on Equifax's online dispute portal to obtain initial remote shell execution." | Indictment ¶ 14, Page 6 | reviewed |
| T1070 | Indicator Removal Defense Evasion | "Defendants routinely deleted temporary files and log entries, routed communications through encrypted tunnels, and ran roughly 9,000 queries to mask their database reconnaissance." | Indictment ¶ 22, Page 11 | reviewed |
| T1567 | Exfiltration Over Web Service Exfiltration | "Operatives packaged stolen records containing names, Social Security numbers, and birth dates into compressed archives and exfiltrated them to overseas staging servers." | Indictment ¶ 26, Page 13 | reviewed |