Hackers backed by Chinese government spy agencies have been accused by the United States and Britain of carrying out a multi-year cyberattack campaign targeting politicians, journalists and businesses.
The US said the operation targeted political dissidents and critics of China in sophisticated phishing campaigns that resulted in the compromise of some email systems and networks.
The U.S. government on Monday announced sanctions against the hackers suspected of operating the scheme. Two individuals and a front company associated with APT31, a cyber espionage group linked to China’s Ministry of State Security, have been sanctioned by the UK.
New Zealand’s government said on Tuesday it had also raised concerns with the Chinese government about its involvement in attacks targeting the country’s parliamentary institutions in 2021.
The U.S. Treasury Department’s Office of Foreign Assets Control announced sanctions against Wuhan Xiaoruizhi Technology Co., which it describes as a front for China’s Ministry of National Security, “has served as a front for multiple malicious cyber operations.”
In a press release and an unsealed indictment, the U.S. government accused China of running a sophisticated and invasive state-sponsored hacking program dating back more than a decade. U.S. Attorney General Merrick Garland said the hacking operation was evidence of “the intent that the Chinese government is willing to use to target and intimidate its critics.”
The Treasury Department has named two Chinese nationals affiliated with a Wuhan company, Zhao Guangzong and Ni Gaobin, on charges of cyber operations targeting critical U.S. infrastructure sectors, including defense, aerospace and energy. It also listed these threats as part of the cyber hacking group APT 31. APT 31 stands for “Advanced Persistent Threat” and includes state-sponsored contract hackers and operatives.
“APT 31 targets a wide range of U.S. government officials and their advisors essential to U.S. national security,” the department said in a press release.
The U.S. Department of Justice has charged Zhao, Ni and five other hackers with computer intrusion and conspiracy to commit wire fraud. The agency said they were part of a 14-year cyber operation that “targeted U.S. and foreign critics, businesses, and political officials.”
“Today’s announcement underscores the need to remain vigilant against cybersecurity threats and the potential for cyber-enabled foreign influence activities, especially as we approach the 2024 election cycle.” said Assistant Secretary Matthew G. Olsen.
The hacking campaign involved the sending of over 10,000 malicious emails containing hidden tracking links that allowed APT 31 to access information about the target, including location and IP address. According to the Justice Department, the emails targeted government officials around the world critical of China policy, including White House staff and campaign workers from both major political parties.
British authorities also impose sanctions
British officials have said those sanctioned by the state have been vocal about threats from China and a hack that may have accessed information on tens of millions of British voters held by the Electoral Commission. He said he was responsible for a cyber espionage operation that targeted members of Congress. .
The Ministry of Foreign Affairs said the hacking of the electoral register “does not affect the electoral process, does not affect the rights or access of any individual to the democratic process, and does not affect electoral registration. ” he said.
The Election Commission announced in August that it had confirmed a system breach in October 2022, but added that “hostile actors” first gained access to the server in 2021.
At the time, the watchdog said the data included the names and addresses of registered voters. However, he said much of the information is already in the public domain.
British authorities have not released the names of the companies or the two individuals. However, they announced that the two sanctioned individuals were involved in the activities of the Chinese cyber group APT 31. This group is also known as zirconium or hurricane pandas.
After newsletter promotion
APT 31 has previously been accused of targeting the US presidential election campaign and the Finnish parliament’s information systems.
British cybersecurity officials say hackers linked to the Chinese government “conducted reconnaissance” on British MPs who criticize the Chinese government in 2021, and that no MPs were successfully infected. Stated.
Three MPs, including former Conservative Party leader Iain Duncan Smith, told reporters on Monday: “We have been subject to harassment, impersonation and attempted hacking from China for some time now.” Duncan Smith said, in one example, a hacker impersonating him emailed his contacts using a fake email address.
The politicians are members of the Inter-Parliamentary Union on China, an international pressure group focused on countering Beijing’s growing influence and denouncing its alleged rights abuses.
British Deputy Prime Minister Oliver Dowden said the British government would summon the Chinese ambassador to account for his actions.
Ahead of the announcement, China’s Ministry of Foreign Affairs said countries should make claims based on evidence, rather than “slandering” other countries without basing them on facts.
Ministry spokesperson Lin Jian said, “Cybersecurity issues should not be politicized.” “We hope all parties will stop spreading false information, behave responsibly, and work together to maintain peace and security in cyberspace.”
British Prime Minister Rishi Sunak reiterated that China is “behaving increasingly assertively abroad” and described it as “the biggest state-based threat to our economic security”.
He declined to provide further details, but said: “It’s right to take steps to protect ourselves. That’s what we’re doing.”
China critics, including Duncan Smith, have long urged Mr Sunak to take a tougher stance on China and characterize the country as a threat rather than a “challenge” to Britain, but the government has rejected such criticism. I have refrained from using such words.
