Microsoft Exchange email server hack blamed on China
THE BIDEN administration and Western allies formally blamed China on Monday for a massive hack of the Microsoft Exchange email server software and accused Beijing of working with criminal hackers on ransomware and other illicit cyber operations.
The announcements, though not accompanied by sanctions against the Chinese government, were i ntended as a forceful condemnation of activities a senior Biden administration official described as part of a “pattern of i rresponsible behaviour i n cyberspace”. They highlighted the ongoing threat from Chinese government hackers, even as the administration remains consumed with trying to curb ransomware attacks from Russia-based syndicates that have targeted critical infrastructure.
The broad range of cyberthreats from Beijing disclosed on Monday included a ransomware attack from government-affiliated hackers that has targeted victims – including in the United States – with demands for millions of dollars. US officials allege that China’s Ministry of State Security has been using criminal contract hackers who have engaged in cyber extortion schemes and theft for their own profit, officials said.
Meanwhile, the US Justice Depar tment on Monday announced charges against four Chinese nationals, who prosecutors said were working with the Ministry of State Security in a hacking campaign that targeted dozens of computer systems, including companies, universities and government entities. The defendants are accused of stealing trade secrets and confidential business information.
Unlike in April, when public finger-pointing of Russian hacking was paired with a raft of sanctions against Moscow, the Biden administration did not announce any actions against Beijing. Nonetheless, a senior administration official who briefed reporters said that the US has confronted senior Chinese officials, and that the White House regards the multi-nation public shaming as sending an important message.
Even without fresh sanctions, the actions on Monday are likely to exacerbate tensions with China at a delicate time. Just last week, the US issued separate stark warnings against transactions with entities that operate in China’s western Xinjiang region, where China is accused of repressing Uyghur Muslims and other minorities. Then on Friday, the administration advised American firms of the deteriorating investment and commercial environment in Hong Kong, where China has been cracking down on democratic freedoms it had pledged to respect in the former British colony.
The European Union and United Kingdom also called out China. The EU said malicious cyber activities with “significant effects” that targeted government institutions, political organisations and key industries in the bloc’s 27 member states could be linked to Chinese hacking groups. The UK’s National Cyber Security Centre said the groups targeted maritime industries and naval defence contractors in the US and Europe, and the Finnish parliament.
In a statement, EU foreign policy chief Josep Borrell said the hacking was “conducted from the territory of China for the purpose of intellectual property theft and espionage”.
The Microsoft Exchange cyberattack “by Chinese statebacked groups was a reckless but familiar pattern of behaviour,” UK Foreign Secretary Dominic Raab said.
NATO, in its first public condemnation of China for hacking activities, called on Beijing to uphold its international commitments and obligations “and to act responsibly in the international system, including in cyberspace”. The alliance said it was determined to “actively deter, defend against and counter the full spectrum of cyber threats”.
That hackers affiliated with the Ministry of State Security were engaged i n ransomware was surprising and concerning to the US government, the senior administration official said. But the attack, in which an unidentified American company received a high-dollar ransom demand, also gave US officials new insight into what the official said was “the kind of aggressive behaviour that we’re seeing coming out of China”.
The majority of the most damaging and high-profile recent ransomware attacks have involved Russian criminal gangs. Though the US has sometimes seen connections between Russian intelligence agencies and individual hackers, the use of criminal contract hackers by the Chinese government “to conduct unsanctioned cyber operations globally is distinct,” the official said.
The Microsoft Exchange hack that months ago compromised tens of thousands of computers around the world, was swiftly attributed to Chinese cyberspies by private-sector groups. An administration official said the government’s attribution to hackers affiliated with China’s Ministry of State Security took until now, in part because of the discovery of the ransomware and for-profit hacking operations, and because the administration wanted to pair the announcement with guidance for businesses about tactics that the Chinese have been using.
An advisory on Monday from the FBI, the National Security Agency and the Cybersecurity and Infrastructure Security Agency laid out specific techniques and ways that US government agencies and businesses can protect themselves.
A spokesperson for the Chinese Embassy in Washington did not immediately respond to an email seeking comment on Monday. But a Chinese Foreign Ministry spokesperson has previously deflected blame for the Microsoft Exchange hack, saying that China “firmly opposes and combats cyberattacks and cybertheft in all forms”, and cautioned that attribution of cyberattacks should be based on evidence and not “groundless accusations”.