US points finger at China over Microsoft Exchange email hack

The two-count indictment, which was returned in May and kept under seal until now, charges Ding Xiaoyang, Cheng Qingmin, and Zhu Yunmin were officers with the Hainan State Security Department, a provincial branch of China’s Ministry of State Security, or MSS.

A fourth charged individual, Wu Shurong, was charged as a computer hacker who created malware and hacked into computers run by foreign governments, companies and universities, and supervised other hackers engaged in such work. The indictment charges that hacking stretched from 2011 to 2018, targeting entities in the US, Austria, Cambodia, Canada, Germany, Indonesia, Malaysia, Norway, Saudi Arabia, South Africa, Switzerland, and Britain.

The announcements highlighted the ongoing cyber threat posed by Chinese government hackers even as the administration has been consumed with trying to curb ransomware attacks from Russia-based syndicates that have targeted critical infrastructure, including a massive fuel pipeline.

Even though the finger-pointing was not accompanied by any sanctions of Beijing, a senior administration official who disclosed the actions to reporters said that the US has confronted senior Chinese officials and that the White House regards the multi-nation public shaming as sending an important message.

That hackers affiliated with the Ministry of State Security carried out a ransomware attack was surprising and concerning to the US government, the senior administration official said. But the attack, in which an unidentified American company received a high-dollar ransom demand, also gave US officials new insight into what the official said was “the kind of aggressive behaviour that we’re seeing coming out of China”.

The European Union also blamed China for what it said were malicious cyber activities with “significant effects” that targeted government institutions and political organisations in the EU and its 27 member states, as well as key European industries.

In a statement, the EU’s foreign policy chief Josep Borrell said the hacking was “conducted from the territory of China for the purpose of intellectual property theft and espionage”.

The majority of the most damaging and high-profile recent ransomware attacks have involved Russian criminal gangs. Though the US has sometimes seen connections between Russian intelligence agencies and individual hackers, the use of criminal contract hackers by the Chinese government “to conduct unsanctioned cyber operations globally is distinct,” the official said.

The Microsoft Exchange hack was first identified in January and was rapidly attributed to Chinese cyber spies by private sector groups. An administration official said the government’s attribution to hackers affiliated with China’s Ministry of State Security took until now in part because of the discovery of the ransomware and for-profit hacking operations and because the administration wanted to pair the announcement with guidance for businesses about tactics that the Chinese have been using.

An advisory on Monday from the FBI, the National Security Agency and the Cybersecurity and Infrastructure Security Agency laid out specific techniques and ways that government agencies and businesses can protect themselves.

The White House also wanted to line up an international coalition of allies to call out China, according to the official, who said it was the first time NATO had condemned Beijing’s hacking operations.

A Chinese Foreign Ministry spokesperson, asked about the Microsoft Exchange hack, has previously said that China “firmly opposes and combats cyber attacks and cyber theft in all forms” and cautioned that attribution of cyberattacks should be based on evidence and not “groundless accusations”.

AP, with The New York Times, Washington Post