Two Chinese nationals are at the centre of US accusations against China of a state-sponsored cyber attack to steal information from 45 US companies and government agencies, including Nasa, the US navy, and the Department of Energy.

On Thursday, US prosecutors charged Zhu Hua and Zhang Shilong with “extensive campaigns of global intrusion” on behalf of China’s ministry of state security to spy on some of the world’s largest companies and internet service providers.

Little is known about Zhu and Zhang, who according to US prosecutors, violated bilateral and international commitments made by their government.

According to the US indictment, Zhu and Zhang were part of a group known as Advanced Persistent Threat 10, APT10, that has been infiltrating computers systems since at least 2006. The group is also known as “Stone Panda,” “Red Apollo,” “MenuPass” and “POTASSIUM.”

Both Zhu and Zhang worked for a company called Huaying Huatai Science and Technology Development company in the northern Chinese city of Tianjin.

Both were also linked with the ministry of state security in Tianjin. Zhu, known by aliases such as “Afwa,” “CVNX,” “Alayos,” and “Godkiller,” was responsible for registering malware domains and hacking infrastructure, as well as recruiting members for APT10, according to the document.

Zhang, whose alternative names include “baobeiling,” “Zhang Jianguo” and “Atreexp”, registered domains and infrastructure as well as tested and developed malware used by the group.

Beginning in or about 2006, the group breached the computers of more than 45 commercial and defence technology companies in aviation, space and satellite technology, pharmaceutical technology, and others in 12 US states, stealing “hundreds of gigabytes of sensitive data,” according to US prosecutors.

In 2014, Zhu and Zhang and other members of the group gained access to the managed service providers, companies that store client data remotely, of businesses and governments in at least 12 countries, including the US, the UK, Canada, Japan, Brazil, France, Finland, Sweden, Switzerland and the United Arab Emirates, Germany, and India. They also obtained the personal data of more than 100,000 personnel working for the US Navy.

According to the indictment, the alleged hackers sent customised emails with malware hidden in attachments related to the recipient. Once opened, the attachment would install malware, including one known as “Poison Ivy” used to steal usernames and passwords as users type them. The malware was also programmed to communicate with domains assigned to IP addresses of computers controlled by APT10.

Zhu and Zhang are not likely to face their charges. In 2014, the US indicted five members of China’s People’s Liberation Army for espionage, but they have never been brought to the US. China’s foreign ministry said on Friday that it resolutely opposes the “slanderous” accusations from the US and urges Washington to withdraw its allegations.

“America and many allies know what China is doing. We know why they are doing it. And in some cases, we even know which individual people are doing it in association with the Chinese government,” deputy attorney general Rod J. Rosenstein of the southern district of New York said on Thursday.

“We hope the day will come when the defendants face justice under the rule of law in a federal courtroom.”