The US administration and allied nations, including Australia, also disclosed a broad range of other cyberthreats from Beijing, including ransomware attacks from government-affiliated hackers that have targeted companies with demands for millions of dollars.
China’s Ministry of State Security has been using criminal contract hackers, who have engaged in cyber extortion schemes and theft for their own profit, according to a senior administration official.
That official briefed reporters about the investigation on the condition of anonymity.
Defence Minister Peter Dutton on Monday night expressed “serious concerns about malicious cyber activities by China’s Ministry of State Security”.
He said the MSS exploited vulnerabilities in the Microsoft Exchange software to affect thousands of computers and networks worldwide, including in Australia.
“These actions have undermined international stability and security by opening the door to a range of other actors, including cybercriminals, who continue to exploit this vulnerability for illicit gain,” he said, in a statement.
“The Australian Government is also seriously concerned about reports from our international partners that China’s Ministry of State Security is engaging contract hackers who have carried out cyber-enabled intellectual property theft for personal gain and to provide commercial advantage to the Chinese Government.”
Mr Dutton called on China to “act responsibly in cyberspace”, abide by its commitments to the G20 and refrain from cyber-enabled theft of intellectual property, trade secrets and confidential business information.
A senior administration official said Australia was among “an unprecedented group of allies… joining the United States in exposing and criticising the PRC’s Ministry of State Security’s malicious cyber activities.”
The Microsoft Exchange Server holds millions of corporate emails, calendars and rostering products and if hacked entire email inboxes could be wiped as well as stolen.
In the wake of the attack, the Australian Signals Directorate’s Australian Cyber Security Centre (ACSC) confirmed Australian organisations — thought to be more than 7000 servers locally — had been affected by the hack.
The announcements highlighted the ongoing cyberthreat posed by Chinese government hackers even as the US administration has been consumed with trying to curb ransomware attacks from Russia-based syndicates that have targeted critical infrastructure, including a massive fuel pipeline.
Even though the finger-pointing was not accompanied by any sanctioning of Beijing, a senior US administration official who disclosed the actions to reporters said the US had confronted senior Chinese officials and that the White House regarded the multi-nation public shaming as sending an important message.
That hackers affiliated with the Ministry of State Security carried out a ransomware attack was surprising and concerning to the US government, the senior administration official said.
But the attack, in which an unidentified American company received a high-dollar ransom demand, also gave US officials new insight into what the official said was “the kind of aggressive behaviour that we’re seeing coming out of China.”
The European Union also blamed China for what it said were malicious cyber activities with “significant effects” that targeted government institutions and political organisations in the EU and its 27 member states, as well as key European industries.
In a statement, the EU’s foreign policy chief Josep Borrell said the hacking was “conducted from the territory of China for the purpose of intellectual property theft and espionage.”
The majority of the most damaging and high-profile recent ransomware attacks have involved Russian criminal gangs.
Though the US has sometimes seen connections between Russian intelligence agencies and individual hackers, the use of criminal contract hackers by the Chinese government “to conduct unsanctioned cyber operations globally is distinct,” the official said.
The Microsoft Exchange hack was first identified in January and was rapidly attributed to Chinese cyber spies by private sector groups.
An administration official said the government’s attribution to hackers affiliated with China’s Ministry of State Security took until now in part because of the discovery of the ransomware and for-profit hacking operations and because the administration wanted to pair the announcement with guidance for businesses about tactics that the Chinese have been using.
An advisory Monday from the FBI, the National Security Agency and the Cybersecurity and Infrastructure Security Agency laid out specific techniques and ways that government agencies and businesses can protect themselves.
The White House also wanted to line up an international coalition of allies to call out China, according to the official, who said it was the first time NATO had condemned Beijing’s hacking operations.
A Chinese Foreign Ministry spokesperson, asked about the Microsoft Exchange hack, has previously said that China “firmly opposes and combats cyber attacks and cyber theft in all forms” and cautioned that attribution of cyberattacks should be based on evidence and not “groundless accusations.”