China’s Cyber Attacks on US and UK: What We Know About the Espionage Campaign

US, UK and New Zealand of targeting sensitive information with cyber hacking attacks

The United States and the United Kingdom have imposed sanctions on individuals and groups accused of participating in a large-scale cyber espionage campaign. The operation, allegedly orchestrated by China’s Ministry of State Security, targeted politicians, journalists, and critics of Beijing. The scope of the cyber attacks was revealed this week, with New Zealand also attributing a separate hacking incident to Chinese-backed cyber actors.

Who is Behind the Cyber Attacks?

The cyber attacks have been attributed to a hacking group known as Advanced Persistent Threat 31 (APT 31), also referred to as Zirconium, Violet Typhoon, Judgment Panda, and Altaire. This group operates under the Ministry of State Security in Wuhan, China. APT 31 is notorious for high-profile attacks, including a 2020 campaign that targeted campaign staff working for Joe Biden, as well as the 2021 hack of Microsoft Exchange servers, which compromised tens of thousands of computers globally.

Additionally, another Chinese-linked hacking group, APT 40, has been blamed for a 2021 attack on New Zealand's parliamentary network, aimed at compromising sensitive government data.

Targets of the Attacks

The targets of this extensive campaign ranged from political dissidents and critics of China to government officials, journalists, and business leaders. The UK government reported two major campaigns in which Beijing allegedly gained access to personal data from 40 million voters between late 2021 and October 2022, although there was no evidence that the electoral process was affected. A more focused attack targeted UK parliamentarians critical of China, though no accounts were compromised.

In the US, the Justice Department described a 14-year-long global operation targeting political dissidents, US government officials, and political candidates. Thousands of individuals and organizations were affected, with some email accounts, cloud storage, and telephone records being compromised. The campaign also focused heavily on activists and journalists involved in the 2019 pro-democracy protests in Hong Kong.

New Zealand also confirmed that some non-sensitive data was stolen during the attack on its parliamentary services.

How Did the Attacks Unfold?

Both the US and UK have reported that APT 31 primarily used phishing techniques to infiltrate systems. The group sent over 10,000 deceptive emails, often disguised as communications from news outlets or political figures. These emails contained links that, when clicked, revealed the recipient’s location, device details, and IP address, allowing APT 31 to gain access to sensitive devices such as home routers.

Goals of the Campaign

The primary objective of APT 31’s cyber espionage operation, according to US authorities, was to repress critics of the Chinese government, infiltrate governmental institutions, and steal trade secrets. The group targeted a wide range of industries, including defense, telecommunications, and manufacturing, successfully compromising intellectual property and economic plans.

In addition to government targets, the spouses of senior US officials and political candidates were also on the hackers' radar, although there was no indication that the attacks were intended to interfere with the 2020 US presidential election.

What’s Next?

Tensions between Beijing and Washington have been escalating over allegations of state-sponsored cyber espionage. Critics in the UK have argued that the government was slow to respond to the attacks, with some MPs calling for a tougher stance on China. Luke de Pulford, executive director of the Inter-Parliamentary Alliance on China (IPAC), expressed frustration with the UK’s delayed acknowledgment of China’s role in the cyber campaign.

In response to the accusations, Chinese officials have denied the allegations, with a spokesperson from the Chinese embassy in the UK stating that China “firmly opposes and combats all forms of cyber attacks” and does not support or condone such activities.