Picture: BLOOMBERG/SIMON DAWSON
Picture: BLOOMBERG/SIMON DAWSON

The US, EU and allies formally attributed the Microsoft Exchange hack to actors affiliated with the Chinese government, and the US and other nations are joining in that assessment, escalating last week’s tension between the White House and China.

The US and a group of allies said on Monday that the Chinese government has been the mastermind behind a series of malicious ransomware, data theft and cyber espionage attacks against public and private entities, including the sprawling Microsoft Exchange hack earlier in 2021.

“The Chinese government must end this systematic cyber sabotage and can expect to be held account if it does not,” UK foreign secretary Dominic Raab said in a statement.

The EU’s foreign policy chief, Josep Borrell, said that the cyberattack was conducted from China and “resulted in security risks and significant economic loss for our government institutions and private companies.”

The activities were linked to the hacker groups Advanced Persistent Threat 40 and Advanced Persistent Threat 31, according to an EU statement on Monday.

The group of nations attributing the attack to China will also include Australia, Canada, New Zealand, Japan and Nato, marking the first condemnation by the North American-European alliance on China’s cyber activities, a senior Biden administration official said.

The announcement will add to the range of issues the US and China have been at odds, including economic, military and political. Those tensions intensified last week when the administration warned investors about the risks of doing business in Hong Kong with an advisory saying China’s push to exert more control over the financial hub threatens the rule of law and endangers employees and data.

The US also charged four Chinese nationals affiliated with the ministry of state security with a campaign to hack into computer systems of dozens of companies, universities and government entities in the US and abroad between 2011 and 2018. The indictment was unsealed on Monday.

President Joe Biden has called competition with China one of the defining challenges of the century. China’s leaders were surprised by the administration’s decision to leave in place tariffs imposed by former president Donald Trump, and were infuriated by its support for reopening a review of how the Covid-19 pandemic started and whether it leaked from a lab in Wuhan.

With the report on Monday, the evidence presented is expected to show how China’s security ministry uses criminal contract hackers to conduct unsanctioned cyber operations globally, including for its own personal profit, the official said.

The Chinese foreign affairs ministry did not immediately reply to a request for comment outside office hours.

In March, the ministry dismissed allegations that China-based government hackers were behind cyberattacks on Microsoft Exchange servers, accusing the company of making “groundless accusations”, and saying that tracing the source of cyberattacks is a “highly sensitive political issue”. China has long insisted that it is not a perpetrator but a victim of cyberattacks.

Fifty tactics

As part of the announcement, the National Security Agency, Cybersecurity and Infrastructure Security Agency (Cisa) and FBI will expose more than 50 tactics Chinese state-sponsored hackers used when targeting US and allied networks, along with advice and technical mitigations to confront threats, the official added.

Among the threats is state-sponsored cyber extortion, also known as ransomware attacks, in which the Chinese government has demanded millions of dollars from private companies in exchange for digital keys that allow victims to regain access to their computer networks, the official said.

Microsoft has previously attributed the hack to Chinese actors and software giant Hafnium. The US’s assessment appears to support Microsoft’s conclusions, attributing the hack to MSS-affiliated actors with “high confidence”, the official said.

The attack against Microsoft’s Exchange e-mail servers exploded over the course of two weeks between late February and early March. Microsoft first released software patches on March 2 to fix the critical vulnerabilities exploited in the hack. The attack exposed tens of thousands of victim e-mail systems, including those of healthcare facilities, manufacturers, energy companies and state and local governments.

Until now, most ransomware attacks had been attributed to East European and North Korean operators. Now, the US is accusing the Chinese government of not only leading malicious cyber operations, but also of hiring mercenaries, according to the official. The claim accuses China of not only sponsoring espionage, but also supporting and possibly endorsing the work of cyber criminals executing these attacks.

Due to the breadth of victims around the world, the formal attribution came only after the US had attained a high confidence level on the source of the hack, and making the announcement in concert with allies, the official said.

Bloomberg News. More stories like this are available on bloomberg.com

subscribe

Would you like to comment on this article or view other readers' comments?
Register (it’s quick and free) or sign in now.

Speech Bubbles

Please read our Comment Policy before commenting.