The US and its allies have officially blamed China for a large-scale cyberattack against Microsoft Exchange Servers, which saw tens of thousands of organisations around the world hacked earlier this year.
In a joint statement with the UK, the European Union, NATO and others, the White House said it had a “high degree of confidence” that a hacking group affiliated to the Chinese state was behind the cyberespionage operation.
Go deeper with GlobalData
On 2 March Microsoft revealed that a “state-sponsored” threat actor had used zero-day exploits to gain access to on-premises Microsoft Exchange Servers, giving attackers access to compromised organisations’ emails and address books, along with a launching point to install malware for further attacks.
At the time Microsoft said it had “high confidence” that a Chinese state-linked group called Hafnium was behind the attack.
In mid-March, the White House promised to name the country behind the Microsoft Exchange hack as consensus grew among security experts that China was behind the mass hack.
While the evidence pointed towards a Chinese state operation, it has historically been rare for governments to officially blame other governments. Cyberattackers often employ techniques to cover their tracks, such as communicating in a different language as a smokescreen.
How well do you really know your competitors?
Access the most comprehensive Company Profiles on the market, powered by GlobalData. Save hours of research. Gain competitive edge.
Thank you!
Your download email will arrive shortly
Not ready to buy yet? Download a free sample
We are confident about the unique quality of our Company Profiles. However, we want you to make the most beneficial decision for your business, so we offer a free sample that you can download by submitting the below form
By GlobalDataBut a spate of high-profile ransomware attacks and supply chain hacks including SolarWinds has placed cybersecurity high on the agenda of the Biden administration.
The White House said that the People’s Republic of China (PRC)’s “pattern of irresponsible behaviour in cyberspace is inconsistent with its stated objective of being seen as a responsible leader in the world”.
UK Foreign Secretary Dominic Raab added: “The cyberattack on Microsoft Exchange Server by Chinese state-backed groups was a reckless but familiar pattern of behaviour. The Chinese Government must end this systematic cyber sabotage and can expect to be held to account if it does not.”
The White House also criticised China’s Ministry of State Security for working with criminal hackers to conduct operations for “their own personal profit”.
Alongside the announcement, the White House said it is launching criminal charges against four Chinese Ministry of State “hackers” for taking part in “multiyear” cyber campaigns targeting multiple US sectors, including the attempted theft of Ebola virus vaccine research.
The statement added: “The PRC’s unwillingness to address criminal activity by contract hackers harms governments, businesses, and critical infrastructure operators through billions of dollars in lost intellectual property, proprietary information, ransom payments, and mitigation efforts.”
President Biden has weighed up responding with offensive action in cyberspace against criminal gangs and nation states attacking the US.
But some cybersecurity experts urged caution when taking that approach.
“If it takes action against China or any other country linked to nation-state hacking, there must be no uncertainty,” said Matt Lock, technical director UK at data security company Varonis.
Ben Read, director of analysis at cybersecurity firm Mandiant Threat Intelligence, said: “The indictment highlights the significant threat to multiple businesses from Chinese espionage. The group’s focus on biomedical research shows that emerging technologies are still a key target for Chinese espionage.
“Alongside that, the theft of negotiating strategies underscores the risk posed to all companies doing business with China, not just those with high-value intellectual property.”
