US, allies accuse China of global cyber hacking

On Monday, the US and a coalition of partners accused China of a global cyber hacking campaign including contract hackers, blaming a big Microsoft attack revealed earlier this year on actors operating on Beijing’s behalf.

The United States is joined by NATO, the European Union, the United Kingdom, Australia, Japan, New Zealand, and Canada in raising new tensions with China.

“The United States and countries around the world are holding the People’s Republic of China accountable for its pattern of irresponsible, disruptive, and destabilizing behavior in cyberspace, which poses a major threat to our economic and national security,” U.S. Secretary of State Anthony Blinken said in a statement on Monday.

On Monday, the US Justice Department announced that four Chinese nationals – three security officers and one contract hacker – had been indicted in a global cyber campaign that targeted dozens of businesses, institutions, and government agencies in the US and abroad. The actions, which took place between 2011 and 2018, were centered on information that would benefit Chinese enterprises and businesses, according to the report.

The launch of a new front in the governments’ battle on hacking comes a month after G7 and NATO leaders joined President Joe Biden in warning China of posing systemic threats to the global order at meetings in Cornwall, England, and Brussels.

The governments explicitly blamed “cyber actors linked with” China’s Ministry of State Security, Blinken, for intrusions into the Microsoft Exchange Server that were revealed in March.

According to Blinken, the governments explicitly ascribed attacks leveraging Microsoft Exchange Server vulnerabilities that were published in March to “cyber actors linked with” China’s Ministry of State Security.

A request for comment from the Chinese Embassy in Washington was not immediately returned. China has previously stated that it is a victim of hacking and that it opposes all sorts of cyber-attacks.

U.S. officials said the scope and scale of hacking attributed to China has surprised them, along with China’s use of “criminal contract hackers.”

“The PRC’s Ministry of State Security (MSS) has fostered an ecosystem of criminal contract hackers who carry out both state-sponsored activities and cybercrime for their own financial gain,” Blinken said.

U.S. security and intelligence agencies will outline more than 50 techniques and procedures that “China state-sponsored actors” use in targeting U.S. networks, a senior administration official said.

Chinese state-sponsored cyber actors consistently scan target networks for critical and high vulnerabilities within days of the vulnerability’s public disclosure, the 31-page U.S. cybersecurity advisory seen by Reuters says.

United States in recent months has focused heavy attention on Russia in accusing Russian cyber hackers of a string of ransomware attacks in the United States.

In Monday’s announcement, U.S. officials formally blamed the Chinese government “with high confidence” for the hack that hit businesses and government agencies in the United States using a Microsoft email service. Microsoft (MSFT.O) has already accused China of responsibility.

The operation specifically exploited weaknesses in Microsoft’s exchange program, a common email software. Cybersecurity experts were shaken by the scale and volume of the incident, totaling thousands of potential U.S. victims.

The senior Biden administration official said U.S. concerns about Chinese cyber activities have been raised with senior Chinese officials. “We’re not ruling out further action to hold the PRC accountable,” the official said.

The United States and China have already been at loggerheads over trade, China’s military buildup, a crackdown on democracy activists in Hong Kong, treatment of the Uyghurs in the Xinjiang region and aggression in the South China Sea.

On Friday, the Biden administration issued an advisory to warn U.S. businesses about risks to their operations and activities in Hong Kong after China’s imposition of a new national security law there last year.

Blinken cited the Justice Department indictment of the three Chinese security officers and a contract hacker as an example of how the United States will impose consequences.

The defendants and officials in the Hainan State Security Department, a regional state security office, tried to hide the Chinese government’s role in the information theft by using a front company, according to the indictment, which was returned in May and unsealed Friday.

The campaign targeted trade secrets in industries including aviation, defense, education, government, health care, biopharmaceutical and maritime industries, the Justice Department statement said.

Victims were in Austria, Cambodia, Canada, Germany, Indonesia, Malaysia, Norway, Saudi Arabia, South Africa, Switzerland, the United Kingdom and the United States.

In a statement, Deputy US Attorney General Lisa Monaco said, “These criminal charges once again highlight China’s continued use of cyber-enabled operations to steal what other countries manufacture, in flagrant contempt of its bilateral and international agreements.”