The U.S., U.K. and their allies formally attributed the Microsoft Exchange hack to actors affiliated with the Chinese government and accused the Chinese government of a broad array of “malicious cyber activities,” escalating last week’s tensions between the White House and China.
The group of nations said Monday that the Chinese government has been the mastermind behind a series of malicious ransomware, data theft and cyber-espionage attacks against public and private entities, including the sprawling Microsoft Exchange hack earlier this year.
“The Chinese Government must end this systematic cyber sabotage and can expect to be held account if it does not,” U.K. Foreign Secretary Dominic Raab said Monday in a statement.
The White House said that it was joining with European nations to expose the scale of China’s activity and will take steps to counter it.
“Responsible states do not indiscriminately compromise global network security nor knowingly harbor cyber criminals — let alone sponsor or collaborate with them,” Secretary of State Antony Blinken said in a statement. “These contract hackers cost governments and businesses billions of dollars in stolen intellectual property, ransom payments, and cybersecurity mitigation efforts, all while the MSS had them on its payroll,” referring to China’s Ministry of State Security.
The European Union’s foreign policy chief Josep Borrell said that the cyberattack was conducted from China and “resulted in security risks and significant economic loss for our government institutions and private companies.” The activities were linked to the hacker groups Advanced Persistent Threat 40 and Advanced Persistent Threat 31, according to an EU statement on Monday.
The group of nations attributing the attack to China includes Australia, Canada, New Zealand, Japan and NATO, marking the first condemnation by the North American-European alliance on China’s cyber activities, the senior Biden administration official said.
Monday’s announcement will add to the range of issues — including economic, military and political — the U.S. and China have been at odds over. Those tensions intensified last week when the administration warned investors about the risks of doing business in Hong Kong with an advisory saying China’s push to exert more control over the financial hub threatens the rule of law and endangers employees and data.
The U.S. also charged four Chinese nationals affiliated with the Ministry of State Security with a campaign to hack into computer systems of dozens of companies, universities and and government entities in the U.S. and abroad between 2011 and 2018. The indictment, which was unsealed Monday, alleges that the hackers targeted, among other things, Ebola vaccine research.
President Joe Biden has called competition with China one of the defining challenges of the century. China’s leaders were surprised by the administration’s decision to leave in place tariffs imposed by former President Donald Trump, and were infuriated by its support for reopening a review of how the Covid-19 pandemic started — and whether it leaked from a lab in Wuhan.
With the report Monday, the U.S. aims to show how China’s Ministry of State Security uses criminal contract hackers to conduct unsanctioned cyber operations globally, including for its own personal profit.
“In some cases, we are aware that PRC government-affiliated cyber operators have conducted ransomware operations against private companies that have included ransom demands of millions of dollars,” the White House said in a fact sheet.
The Chinese Ministry of Foreign Affairs did not immediately reply to a request for comment outside of office hours. In March, the ministry dismissed allegations that China-based government hackers were behind cyberattacks on Microsoft Exchange servers, accusing the company of making “groundless accusations,” and saying that tracing the source of cyberattacks is a “highly sensitive political issue.” China has long insisted that it is not a perpetrator but a victim of cyberattacks.
50 Tactics
As part of the announcement, the National Security Agency, the Cybersecurity and Infrastructure Security Agency and Federal Bureau of Investigation detailed more than 50 tactics Chinese state-sponsored cyber hackers used when targeting U.S. and allied networks, including spearphishing emails with malicious attachments, exploitation of public-facing applications and drive-by compromise.
The agencies also provided advice and technical mitigations to confront threats, such as installing patches to protect against system vulnerabilities, strengthening login and password requirements and storing critical information on air-gapped systems.
Among the threats is state-sponsored cyber extortion, also known as ransomware attacks, in which the Chinese government has demanded millions of dollars from private companies in exchange for digital keys that allow victims to regain access to their computer networks, the official said.
Microsoft Corp. has previously attributed the hack to Chinese actors the software giant called Hafnium. The U.S.’s assessment appears to support Microsoft’s conclusions, attributing the hack to MSS-affiliated actors with “a high degree of confidence,” according to the fact sheet.
The attack against Microsoft’s Exchange email servers exploded over the course of two weeks between late February and early March. Microsoft first released software patches on March 2 to fix the critical vulnerabilities exploited in the hack. The attack exposed tens of thousands of victim email systems, including those of health-care facilities, manufacturers, energy companies and state and local governments.
Until now, most ransomware attacks had been attributed to Eastern European and North Korean operators. Now, the U.S. is accusing the Chinese government of not only leading malicious cyber operations, but also of hiring mercenaries, according to the official. The claim accuses China of not only sponsoring espionage, but also supporting and possibly endorsing the work of cyber criminals executing these attacks.
Due to the breadth of victims around the world, the formal attribution came only after the U.S. had attained a high confidence level on the source of the hack, and the announcement could be made in concert with allies, the official added.