Biden administration blames China-linked hackers for Microsoft cyber attack

[ad_1]

WASHINGTON — The Biden administration has publicly blamed hackers from China’s main intelligence service for a far-reaching cyber attack on Microsoft Corp’s email program this year, as part of a global effort by dozens of countries to condemn Beijing’s malicious cyber activities.

Senior officials said the US government has great confidence that hackers linked to the Department of State Security carried out the unusually random hack of Microsoft Exchange Server that surfaced in March.

In addition, four Chinese nationals have been indicted over a series of separate decade-old hacks that allegedly stole corporate secrets and research from companies and universities around the world. Three of the citizens were described as MSS officers, while a fourth was said to work for a Chinese front company that aided in the hacking.

“The United States and countries around the world hold the People’s Republic of China (PRC) responsible for its pattern of irresponsible, disruptive, and destabilizing behavior in cyberspace, which poses a significant threat to our economic and national security,” Secretary of State Anthony Blinken said Monday. He added that MSS “has bolstered an ecosystem of criminal hackers who carry out both state-sponsored activities and cybercrime for their own financial gain.”

The United Kingdom and the European Union, among other countries, have joined in attributing the Microsoft Exchange Server hacking activity, which has made an estimated hundreds of thousands of mostly small businesses and organizations vulnerable to hacking. The Microsoft hack attributed to China was part of a broader global criticism on Monday of cyber attacks launched by Beijing by the United States, the European Union, the United Kingdom, Canada, Australia, New Zealand, Japan and the North Atlantic Treaty Organization, or NATO, an alliance of 30 countries. .

Biden administration officials have described the mass condemnation as the largest international effort yet to criticize Beijing’s state-sponsored hacking. While statements have varied, the international group has generally called on China to engage in malicious cyber activity, including intellectual property theft.

However, public shame did not include punitive measures, such as sanctions or diplomatic expulsions by the United States, and this contrasts with the way the administration has recently punished Russia for a range of allegedly malicious cyber activities, and the discrepancy has drawn criticism from some cybersecurity. specialists.

The lack of further punishment “seems like a double standard compared to actions against Russian actors.” Dmitriy Alperovich, president of Silverado Policy Accelerator, a Washington-based think-tank that modernizes cybersecurity strategy in the United States, said, “We’re dealing with China with gloved hands. “.

The Microsoft hack has left an estimated hundreds of thousands of mostly small businesses and organizations vulnerable to cyber-intrusion. Photo: Stephen Sene/The Associated Press

A senior official said the administration understands that no single measure is able to change the Chinese government’s malicious cyber behavior, and that the focus is on bringing countries together in a united stance against Beijing. The official said that MSS-linked hackers are using criminal contractors to conduct “unauthorized” cyber operations globally.

When asked by reporters what he thinks the difference is between piracy that originated in China and Russia, President Biden said, “My understanding is that the Chinese government, no different from the Russian government, does not do it themselves, but protects those who do, perhaps even making them able to do so.”

The US-led announcement is the most significant action the Biden administration has taken to date regarding China’s years-long campaign of cyber attacks against the US government and US companies, which often involve routine nation-state espionage and theft of valuable intellectual property such as naval technology and the coronavirus. Vaccine data.

The indictment released by the Department of Justice on Monday alleges that the Chinese government did little to support a 2015 agreement between China and the Obama administration not to direct or support cyberattacks that steal corporate records for economic benefit. The Trump administration has also said that Beijing has repeatedly violated the agreement. The indictment, dating back to May, accuses a regional branch of MSS of relying on a front company, whose payroll was coordinated through a local university, to continue such attacks after the agreement was signed.

The indictment accuses the four men of masterminding a hacking campaign from 2011 to 2018 aimed at benefiting businesses and commercial sectors in China by stealing intellectual property and commercial information. The indictment directly related to the Microsoft Exchange Server hack did not surface, but it accused the hackers of stealing information from dozens of companies and universities around the world on Ebola research, marine research and other topics.

US authorities have accused China of widespread hacking targeting US companies and government agencies for years. Historically, China has denied these allegations. A spokesman for the Chinese embassy in Washington did not immediately respond to a request for comment.

The Exchange Server hack was revealed by Microsoft in March along with a software patch to fix bugs that were exploited in the attack. Microsoft at the time identified the perpetrators as a Chinese cyber-espionage group with ties to the state it referred to as Hafnium, an assessment supported by other cybersecurity researchers. The Biden administration has not provided attribution yet, essentially agreeing with the private sector’s conclusions and providing a more detailed identification.

The attack on Exchange Server systems began slowly and covertly in early January by hackers who have previously targeted infectious disease researchers, law firms and universities, according to cybersecurity officials and analysts. But the pace of operations appears to have intensified with the involvement of other hacking groups linked to China, infecting thousands of servers while Microsoft worked to send a software patch to its customers in early March.

Microsoft praised the global measure on Monday. “Attributes like these will help the international community to ensure that those behind indiscriminate attacks are held accountable,” said Tom Burt, Microsoft vice president of customer security and trust.

On Monday, the National Security Agency, the Federal Bureau of Investigation and Cyber ​​Security and the Infrastructure Security Agency also released technical details of more than 50 tactics and techniques favored by hackers linked to the Chinese government, the official said. The release of such lists is common when the United States exposes or highlights malicious hacking campaigns and is intended to help companies and critical infrastructure operators better protect their computer systems.

“The failure to punish any actors affiliated with the People’s Republic of China has been one of the most bewildering and most productive failures of our cross-administration policy towards China.” ”

– Dmitriy Alperovich, Silverado Policy Accelerator

Cybersecurity experts have been pressing the Biden administration for months to respond to China’s alleged involvement in the Microsoft email hack.

“Microsoft Exchange hacks by MSS contractors are the most reckless cyber attacks we’ve seen to date from Chinese actors — and they are far more dangerous than hacking of Microsoft Exchange by MSS contractors,” Silverado’s Alperovitch said, referring to the large-scale cyber espionage campaign that was discovered last December. Russia’s SolarWinds” This, along with other alleged activities, led to a range of punitive measures being taken against Moscow.

Many analysts said the Biden administration broke with years of US foreign policy that tolerated cyber espionage as an acceptable form of the 21st century when it sanctioned Russia earlier this year for SolarWinds.

Keelen Dwyer, a former attorney general who served last year as a deputy assistant attorney general in the Department of Justice’s National Security Division, said the SolarWinds attack “was an espionage attack, and was relatively cautious about inflicting collateral damage.”

Subscribe to newsletters

Capital Journal

Scoops, analysis, and insights driving Washington from the Wall Street Journal’s DC office.

Meanwhile, Mr. Dwyer said, Chinese actors allegedly involved in the Microsoft Exchange hack have seized vast swathes of data and “randomly scanned the entire Internet to find unpatched vulnerabilities”. “This should definitely be a benchmark that we want to set and sanctions to be met,” he said.

The Chinese defendants charged in the new indictment are not in US custody. Some cybersecurity experts have said that indictments against state-backed foreign hackers often have little effect, because defendants rarely appear in a US court. US officials have defended the practice, saying it helps convince allied governments, the private sector and others about the scope of the problem.

Hackers are accused of infiltrating dozens of schools, companies, and government agencies around the world, from a research facility in California and Florida focused on virus therapies and vaccines, to a Swiss chemical company that produces marine paint, to the University of Pennsylvania with a robotics engineering program and the National Institutes of Health, for two Saudi government ministries. Companies and universities are not mentioned in the indictment.

The indictment said the hackers used fake phishing emails and stored the stolen data on GitHub, to hide files in photos of Koala and Donald Trump. She said they coordinated with professors at a Chinese university, including identifying and recruiting hackers for their campaign, and used the university’s library address as the front company’s website.

Microsoft Hack

More WSJ coverage of the Exchange Server cyber attack, outlined by the editors.

– Lawrence Norman and Andrew Restuccia contributed to this article.

Write to Dustin Volz at [email protected] and Aruna Viswanatha at [email protected]

Copyright © 2021 Dow Jones & Company, Inc. all rights are save. 87990cbe856818d5eddac44c7b1cdeb8

.

[ad_2]