The U.S., U.K. and allies formally attributed the Microsoft Exchange hack to actors affiliated with the Chinese government, and other nations are joining in that assessment, escalating last week’s tensions between the White House and China.
The U.S. and a group of allies said Monday that the Chinese government has been the mastermind behind a series of malicious ransomware, data theft and cyber-espionage attacks against public and private entities, including the sprawling Microsoft Exchange hack earlier this year.
“The Chinese Government must end this systematic cyber sabotage and can expect to be held account if it does not,” U.K. Foreign Secretary Dominic Raab said Monday in a statement.
The European Union’s foreign policy chief Josep Borrell said that the cyberattack was conducted from China and “resulted in security risks and significant economic loss for our government institutions and private companies.” The activities were linked to the hacker groups Advanced Persistent Threat 40 and Advanced Persistent Threat 31, according to an EU statement on Monday.
The group of nations attributing the attack to China will also include Australia, Canada, New Zealand, Japan and NATO, marking the first condemnation by the North American-European alliance on China’s cyber activities, a senior Biden administration official said.
Monday’s announcement will add to the range of issues the U.S. and China have been at odds—including economic, military and political. Those tensions intensified last week when the administration warned investors about the risks of doing business in Hong Kong with an advisory saying China’s push to exert more control over the financial hub threatens the rule of law and endangers employees and data.
The U.S. also charged four Chinese nationals affiliated with the Ministry of State Security with a campaign to hack into computer systems of dozens of companies, universities and and government entities in the U.S. and abroad between 2011 and 2018. The indictment was unsealed Monday.
President Joe Biden has called competition with China one of the defining challenges of the century. China’s leaders were surprised by the administration’s decision to leave in place tariffs imposed by former President Donald Trump, and were infuriated by its support for reopening a review of how the COVID-19 pandemic started—and whether it leaked from a lab in Wuhan.
With the report Monday, the evidence presented is expected to show how China’s Ministry of State Security uses criminal contract hackers to conduct unsanctioned cyber operations globally, including for its own personal profit, the official said.
The Chinese Ministry of Foreign Affairs did not immediately reply to a request for comment outside of office hours. In March, the ministry dismissed allegations that China-based government hackers were behind cyberattacks on Microsoft Exchange servers, accusing the company of making “groundless accusations,” and saying that tracing the source of cyberattacks is a “highly sensitive political issue.” China has long insisted that it is not a perpetrator but a victim of cyberattacks.
50 Tactics
As part of the announcement, the National Security Agency, CISA and Federal Bureau of Investigation will expose more than 50 tactics Chinese state-sponsored cyber hackers used when targeting U.S. and allied networks, along with advice and technical mitigations to confront threats, the official added.
Among the threats is state-sponsored cyber extortion, also known as ransomware attacks, in which the Chinese government has demanded millions of dollars from private companies in exchange for digital keys that allow victims to regain access to their computer networks, the official said.
Microsoft Corp. has previously attributed the hack to Chinese actors the software giant called Hafnium. The U.S.’s assessment appears to support Microsoft’s conclusions, attributing the hack to MSS-affiliated actors with “high confidence,” the official said.
The attack against Microsoft’s Exchange email servers exploded over the course of two weeks between late February and early March. Microsoft first released software patches on March 2 to fix the critical vulnerabilities exploited in the hack. The attack exposed tens of thousands of victim email systems, including those of health-care facilities, manufacturers, energy companies and state and local governments.
Until now, most ransomware attacks had been attributed to Eastern European and North Korean operators. Now, the U.S. is accusing the Chinese government of not only leading malicious cyber operations, but also of hiring mercenaries, according to the official. The claim accuses China of not only sponsoring espionage, but also supporting and possibly endorsing the work of cyber criminals executing these attacks.
Due to the breadth of victims around the world, the formal attribution came only after the U.S. had attained a high confidence level on the source of the hack, and making the announcement in concert with allies, the official added.
Subscribe to Fortune Daily to get essential business stories straight to your inbox each morning.
