US points finger at China over Microsoft Exchange email hack

By Eric TuckerUpdated July 19, 2021 â€" 11.20pmfirst published at 9.36pmNormal text sizeLarger text sizeVery large text size

Washington The Biden administration has blamed China for a hack of Microsoft Exchange email server software that compromised tens of thousands of computers around the world earlier this year.

The administration and allied nations on Monday also disclosed a broad range of other cyber threats from Beijing, including ransomware attacks from government-affiliated hackers that have targeted companies with demands for millions of dollars.

The US administration has pointed the finger at China over a hack of Microsoft Exchange earlier this year.Credit:AP

China’s Ministry of State Security has been using criminal contract hackers, who have engaged in cyber extortion schemes and theft for their own profit, according to a senior administration official. That official briefed reporters about the investigation on the condition of anonymity.

Australia joined Britain, Canada, the EU, Japan and New Zealand in the condemnation of China in the first such statement from NATO publicly targeting Beijing for cybercrimes.

A statement from the Australian government said it had “determined that China’s Ministry of State Security exploited vulnerabilities in the Microsoft Exchange software to affect thousands of computers and networks worldwide, including in Australia’.

“These actions have undermined international stability and security by opening the door to a range of other actors, including cybercriminals, who continue to exploit this vulnerability for illicit gain,” the statement said.

The government also said it was “seriously concerned” about reports from international partners that China was “engaging contract hackers who have carried out cyber-enabled intellectual property theft for personal gain and to provide commercial advantage to the Chinese Government”.

Meanwhile, three Chinese security officials have been indicted by a US grand jury as part of what authorities say was a far-reaching hacking scheme targeting companies, universities, and government entities in other countries - the latest in American efforts to “name and shame” hacking by foreign state actors.

The Justice Department unsealed an indictment charging four individuals in China, saying they worked together to try to steal data that would benefit Chinese companies, particularly research and development work.

Advertisement

The two-count indictment, which was returned in May and kept under seal until now, charges Ding Xiaoyang, Cheng Qingmin, and Zhu Yunmin were officers with the Hainan State Security Department, a provincial branch of China’s Ministry of State Security, or MSS.

A fourth charged individual, Wu Shurong, was charged as a computer hacker who created malware and hacked into computers run by foreign governments, companies and universities, and supervised other hackers engaged in such work. The indictment charges that hacking stretched from 2011 to 2018, targeting entities in the US, Austria, Cambodia, Canada, Germany, Indonesia, Malaysia, Norway, Saudi Arabia, South Africa, Switzerland, and Britain.

The announcements highlighted the ongoing cyber threat posed by Chinese government hackers even as the administration has been consumed with trying to curb ransomware attacks from Russia-based syndicates that have targeted critical infrastructure, including a massive fuel pipeline.

Even though the finger-pointing was not accompanied by any sanctions of Beijing, a senior administration official who disclosed the actions to reporters said that the US has confronted senior Chinese officials and that the White House regards the multi-nation public shaming as sending an important message.

That hackers affiliated with the Ministry of State Security carried out a ransomware attack was surprising and concerning to the US government, the senior administration official said. But the attack, in which an unidentified American company received a high-dollar ransom demand, also gave US officials new insight into what the official said was “the kind of aggressive behaviour that we’re seeing coming out of China”.

The European Union also blamed China for what it said were malicious cyber activities with “significant effects” that targeted government institutions and political organisations in the EU and its 27 member states, as well as key European industries.

In a statement, the EU’s foreign policy chief Josep Borrell said the hacking was “conducted from the territory of China for the purpose of intellectual property theft and espionage”.

The majority of the most damaging and high-profile recent ransomware attacks have involved Russian criminal gangs. Though the US has sometimes seen connections between Russian intelligence agencies and individual hackers, the use of criminal contract hackers by the Chinese government “to conduct unsanctioned cyber operations globally is distinct,” the official said.

The Microsoft Exchange hack was first identified in January and was rapidly attributed to Chinese cyber spies by private sector groups. An administration official said the government’s attribution to hackers affiliated with China’s Ministry of State Security took until now in part because of the discovery of the ransomware and for-profit hacking operations and because the administration wanted to pair the announcement with guidance for businesses about tactics that the Chinese have been using.

An advisory on Monday from the FBI, the National Security Agency and the Cybersecurity and Infrastructure Security Agency laid out specific techniques and ways that government agencies and businesses can protect themselves.

The White House also wanted to line up an international coalition of allies to call out China, according to the official, who said it was the first time NATO had condemned Beijing’s hacking operations.

A Chinese Foreign Ministry spokesperson, asked about the Microsoft Exchange hack, has previously said that China “firmly opposes and combats cyber attacks and cyber theft in all forms” and cautioned that attribution of cyberattacks should be based on evidence and not “groundless accusations”.

AP, with The New York Times, Washington Post

Most Viewed in World

Share this post