German drugmaker Bayer AG has blamed an allegedly Chinese government-backed hacking group for a cyberattack against its network.

The attack is said to have been detected first in Bayer’s network early last year. The company reportedly was silently monitoring its behavior for more than a year before deciding to cease the attack and call authorities.

The strange decision to allow an attack to proceed, presumably with safeguards, appears to have been an attempt by security staff at Bayer to track its origins, which they now have.

Bayer didn’t hold back, saying that the malware used was a form of Winnti deployed by the Chinese hacking group Wicked Panda.

Winked Panda was one of a group of “Winnti Umbrella” groups detailed in a report in May that was claimed to be linked to a Chinese government intelligence agency.

Winnti is used as a “remote-access trojan” virus that allows those behind it to infiltrate targeted networks and install other forms of malicious software on demand.

Its best-known victim to date was German steel and elevator conglomerate ThyssenKrupp AG who had trade secrets stolen in 2016. According to Reuters, at least five other German companies may have been hacked using Winnti since that time.

Bayer emphasized that no data was stolen, saying in a statement that “there is no evidence of data outflow.”

Ryan Wilk, vice president of customer success for Mastercard company NuData Security Inc., told SiliconANGLE that it looks like a case of espionage by hackers.

“Bad actors probe company systems tirelessly until they find a security gap to squeeze into and access sensitive information,” Wilk said. “Continuously reviewing security defenses and regularly implementing software patches is more important than ever for securing a company’s systems.”

Photo: conanil/Flickr