Targeting of Thinktank (智库)

People talk about targeting of Thinktank by APT. But not just from China but also Russia and other smaller country - maybe Vietnam. For my first article I would like to talk about the reasoning behind this and why I think people have the wrong understanding.


I take the following from wikipedia:

A think tank or policy institute, research institute, etc. is an organization that performs research and advocacy concerning topics such as social policy, political strategy, economics, military, technology, and culture. Most policy institutes are non-profit organizations, which some countries such as the United States and Canada provide with tax exempt status. Other think tank are funded by governments, advocacy groups, or businesses, or derive revenue from consulting or research work related to their projects.

I have highlighted the words that are important.

Thinktank are contracted by government to study subjects for the purpose of creating policy, law or strategy. 你明白了吗？

In one such blog written by crowdstrike they refer to a group they name 'deep panda' (here). I will perhaps stray away from talking about their provocative naming convention. In this blog they make a conclusion based on targeting of thinktank employees. I believe this to be incorrect. Based on my experience (and I have lots) thinktank are not targeted because "their private correspondence is of extreme interest to these attackers". In many case this information would interesting to the operation but almost never the primary focus. Why fight an army to kill one small man?

Many thinktank are targeted for their disposition to future government policy. If I want to know how the united states will in the future position themselves in subjects such as green energy, counter terrorism or visa application process then thinktank may be the best source of this information. Knowing how one crafts their thoughts is extremely valuable.

Deep indeed.