Cyberwarfare by China

Cyberwarfare by China is the aggregate of all combative activities in the cyberspace which are taken by organs of the People's Republic of China, including affiliated advanced persistent threat groups, against other countries.

Organization

While some details remain unconfirmed, it is understood that China organizes its resources as follows:

• “Specialized military network warfare forces” (Chinese: 军队专业网络战力量) - Military units specialized in network attack and defense.
• "PLA-authorized forces” (授权力量) - network warfare specialists in the Ministry of State Security (MSS) and the Ministry of Public Security (MPS).
• “Non-governmental forces” (民间力量) - civilian and semi-civilian^{[definition needed]} groups that spontaneously engage in network attack and defense.^[1]

In 2017, Foreign Policy provided an estimated range for China's "hacker army" personnel, anywhere from 50,000 to 100,000 individuals.^[2]

In response to claims that Chinese universities, businesses, and politicians have been subject to cyber espionage by the United States National Security Agency since 2009,^[3][4] the PLA announced a cyber security squad in May 2011 to defend their own networks.^[5]

List of APTs

Since Xi Jinping became General Secretary of the Chinese Communist Party in 2012, the Ministry of State Security gained more responsibility over cyberespionage vis-à-vis the People's Liberation Army, and currently oversees various APT groups.^[6] According to security researcher Timo Steffens, "the APT landscape in China is run in a 'whole country' approach, leveraging skills from universities, individual, and private and public sectors".^[7]

• PLA Unit 61398 (also known as APT1)
• PLA Unit 61486 (also known as APT2)
• Buckeye (also known as APT3)^[8]
• Red Apollo (also known as APT10)
• Numbered Panda (also known as APT12)
• DeputyDog (also known as APT17)^[9]
• Codoso Team (also known as APT19)
• Wocao (also known as APT20)^[10][11]
• APT 27^[12]
• PLA Unit 78020 (also known as APT30 and Naikon)
• Zirconium^[13] (also known as APT31 and Violet Typhoon)^[14][15]
• Periscope Group (also known as APT40)
• Double Dragon^[16] (also known as APT41, Winnti Group, Barium, or Axiom)^[17][18][19]
• Dragonbridge^[20]
• Hafnium^[21][22]
• LightBasin^[23][24] (Also known as UNC1945)
• Tropic Trooper^[25][26]
• Volt Typhoon^[27]

Accusations of espionage and cyber-attacks

See also: Chinese intelligence activity abroad, Great Cannon, and Chinese information operations and information warfare

Australia

In May 2013, ABC News claimed that the Chinese government stole blueprints to the headquarters of the Australian Security Intelligence Organisation (ASIO).^[28] In May 2023, Australia, alongside other Five Eyes member states, identified the Chinese government behind the "Volt Typhoon" advanced persistent threat targeting critical infrastructure.^[29]

Canada

Officials in the Canadian government claimed that Chinese hackers compromised several departments within the federal government in early 2011, though the Chinese government has denied involvement.^[30] In 2014, Canada's Chief Information Officer claimed that Chinese hackers compromised computer systems within the National Research Council.^[31] In May 2023, Canada's Communications Security Establishment identified the Chinese government as being behind the "Volt Typhoon" advanced persistent threat targeting critical infrastructure.^[32]

India

Officials in the Indian government believe that attacks on Indian government networks, such as the attack on the Indian National Security Council, have originated from China. According to the Indian government, Chinese hackers are experts in operating botnets, of which were used in these attacks.^[33] Additionally, other instances of Chinese cyberattacks against India's cyberspace have been reported in multitude.^[34][35]

Japan

In April 2021 Japan claimed that the Chinese military ordered cyberattacks on about 200 Japanese companies and research institutes, including JAXA.^[36]

The Netherlands

In 2024, the Dutch Military Intelligence and Security Service and the General Intelligence and Security Service stated that Chinese state hackers penetrated a Dutch military network the prior year.^[37]

New Zealand

In May 2023, New Zealand, alongside other Five Eyes member states, named the Chinese government as being behind the "Volt Typhoon" advanced persistent threat targeting critical infrastructure.^[38]

United States

See also: Chinese espionage in the United States

The United States has accused China of cyberwarfare attacks that targeted the networks of important American military, commercial, research, and industrial organizations. A Congressional advisory group has declared China "the single greatest risk to the security of American technologies"^[39] and "there has been a marked increase in cyber intrusions originating in China and targeting U.S. government and defense-related computer systems".^{[39][40][41][42]}

In January 2010, Google reported targeted attacks on its corporate infrastructure originating from China "that resulted in the theft of intellectual property from Google." Gmail accounts belonging to two human rights activists were compromised in an attack on Google's password system.^[43] Chinese hackers also gained access to a database containing classified information about suspected spies, agents, and terrorists under surveillance by the US government.^[44] American security experts connected the Google attack to various other political and corporate espionage efforts originating from China, which included spying against military, commercial, research, and industrial corporations.^[42] Obama administration officials called the cyberattacks "an increasingly serious cyber threat to US critical industries."^[40]

In addition to Google, at least 34 other companies have been attacked. Reported cases include Northrop Grumman, Symantec, Yahoo, Dow Chemical, and Adobe Systems.^[45] Cyber-espionage has been aimed at both commercial and military interests.^[46]

Diplomatic cables highlight US concerns that China is exploiting its access to Microsoft source code to boost its offensive and defensive capabilities.^[47]

A number of private computer security firms have stated that they have growing evidence of cyber-espionage efforts originating from China, including the "Comment Group".^[48]

China has denied accusations of cyberwarfare,^[49] and has accused the United States of engaging in cyber-warfare against it, accusations which the United States denies.^{[50][51][52][53][54]}

During March 2013, high-level discussions continued.^[55]

In May 2014, a federal grand jury in the United States indicted five PLA Unit 61398 officers on charges of theft of confidential business information from U.S. commercial firms and planting malware on their computers.^[56][57]

In September 2014, a Senate Armed Services Committee probe revealed hackers associated with the Chinese government committing various intrusions of computer systems belonging to U.S. airlines, technology companies and other contractors involved with the movement of U.S. troops and military equipment,^[58] and in October 2014, The FBI added that hackers, who they believe to be backed by the Chinese government, have recently launched attacks on U.S. companies.^[59]

In 2015, the U.S Office of Personnel Management (OPM) announced that it had been the target of a data breach targeting the records of as many as 21.5 million people.^[60] The Washington Post reported that the attack came from China, citing unnamed government officials.^[61] FBI director James Comey explained "it is a very big deal from a national security perspective and a counterintelligence perspective. It's a treasure trove of information about everybody who has worked for, tried to work for, or works for the United States government."^[62]

In 2019, a study showed continued attacks on the US Navy and its industrial partners.^[63]

In February 2020, a US federal grand jury charged four members of China's People's Liberation Army (PLA) with the 2017 Equifax hack.^[64] The official account of FBI stated on Twitter that they played a role in "one of the largest thefts of personally identifiable information by state-sponsored hackers ever recorded", involving "145 million Americans".^[65]

The Voice of America reported in April 2020 that "U.S. intelligence agencies concluded the Chinese hackers meddled in both the 2016 and 2018 elections" and said "there have already been signs that China-allied hackers have engaged in so-called "spear-phishing" attacks on American political targets" ahead of the 2020 United States elections.^[66]

In March 2021, United States intelligence community released analysis in finding that China had considered interfering with the election but decided against it on concerns it would fail or backfire.^[67]

In April 2021, FireEye said that suspected Chinese hackers used a zero-day attack against Pulse Connect Secure devices, a VPN device, in order to spy on dozens of government, defense industry and financial targets in the U.S. and Europe.^{[68][69][70][71]}

In May 2023, Microsoft and Western intelligence agencies reported that a Chinese state-sponsored hacking group affiliated with the PLA called "Volt Typhoon" had targeted critical infrastructure and military installations in Guam, Hawaii, Texas and elsewhere.^[72][73][74] In January 2024, US authorities stated that they disrupted an operation by Volt Typhoon that had access to critical infrastructure in the US for at least five years.^[75][76]

Taiwan

Comparing the semiconductor industry in China mainland and Taiwan today, Taiwan is the leader in terms of overall competitiveness. On 6 August 2020, Wired published a report, stating that "Taiwan has faced existential conflict with China for its entire existence and has been targeted by China's state-sponsored hackers for years. But an investigation by one Taiwanese security firm has revealed just how deeply a single group of Chinese hackers was able to penetrate an industry at the core of the Taiwanese economy, pillaging practically its entire semiconductor industry."^[77]

Ukraine

In April 2022, The Times reported that days prior to the start of the 2022 Russian invasion of Ukraine, a cyberwarfare unit of the People's Liberation Army launched cyberattacks against hundreds of Ukrainian government sites, according to officials of the Security Service of Ukraine.^[78][79]

United Kingdom

In May 2023, the UK's National Cyber Security Centre, alongside other Five Eyes member states, identified the Chinese government behind the "Volt Typhoon" advanced persistent threat targeting critical infrastructure.^[29][80]

The Vatican

In July 2020 it was reported that Chinese state-sponsored hackers operating under the named RedDelta hacked the Vatican's computer network ahead of negotiations between China and the Vatican.^[81]

IP hijacking

During 18 minutes on April 8, 2010, state-owned China Telecom advertised erroneous network routes that instructed "massive volumes" of U.S. and other foreign Internet traffic to go through Chinese servers. A US Defense Department spokesman told reporters that he did not know if "we've determined whether that particular incident ... was done with some malicious intent or not" and China Telecom denied the charge that it "hijacked" U.S. Internet traffic.^[82]

See also

• 2011 Canadian government hackings
• Beijing–Washington cyber hotline
• Chinese intelligence activity abroad
• Chinese information operations and information warfare
• Cyberwarfare by Russia
• Death of Shane Todd
• GhostNet
• Google China
• Honker Union
• List of cyber warfare forces - China
• Operation Aurora
• Operation Shady RAT
• Titan Rain
• People's Liberation Army Strategic Support Force
• PLA Unit 61398
• Red Apollo
• 2021 Microsoft Exchange Cyberattack

References

1. Elegant, Simon (November 18, 2009). . Time. Archived from the original on October 24, 2010. Retrieved October 25, 2010.
2. "China's Hacker Army March 9, 2017, at the Wayback Machine". Foreign Policy.
3. "Archived copy". The Washington Post. from the original on March 6, 2019. Retrieved August 26, 2017.{{cite news}}: CS1 maint: archived copy as title (link)
4. "Snowden says U.S. hacking targets China; NSA points to thwarted attacks". The Japan Times. June 14, 2013. from the original on June 15, 2013. Retrieved June 13, 2013.
5. Beech, Hannah. "Meet China's Newest Soldiers: An Online Blue Army". May 27, 2011, at the Wayback Machine Time, 27 May 2011.
6. Mozur, Paul; Buckley, Chris (August 26, 2021). "Spies for Hire: China's New Breed of Hackers Blends Espionage and Entrepreneurship". The New York Times. ISSN 0362-4331. from the original on August 27, 2021. Retrieved August 27, 2021.
7. Stone, Jeff (October 5, 2020). "Foreign spies use front companies to disguise their hacking, borrowing an old camouflage tactic". cyberscoop.com. Cyberscoop. from the original on March 22, 2021. Retrieved October 11, 2020.
8. "Buckeye: Espionage Outfit Used Equation Group Tools Prior to Shadow Brokers Leak". Symantec. May 7, 2019. Archived from the original on May 7, 2019. Retrieved July 23, 2019.
9. "APT17: Hiding in Plain Sight - FireEye and Microsoft Expose Obfuscation Tactic" (PDF). FireEye. May 2015. (PDF) from the original on November 24, 2023. Retrieved January 21, 2024.
10. van Dantzig, Maarten; Schamper, Erik (December 19, 2019). (PDF). fox-it.com. NCC Group. Archived from the original (PDF) on March 22, 2021. Retrieved December 23, 2019.
11. Vijayan, Jai (December 19, 2019). "China-Based Cyber Espionage Group Targeting Orgs in 10 Countries". www.darkreading.com. Dark Reading. from the original on May 7, 2021. Retrieved January 12, 2020.
12. Lyngaas, Sean (August 10, 2021). "Chinese hackers posed as Iranians to breach Israeli targets, FireEye says". www.cyberscoop.com. from the original on November 29, 2023. Retrieved August 15, 2021.
13. Lyngaas, Sean (February 12, 2019). "Right country, wrong group? Researchers say it wasn't APT10 that hacked Norwegian software firm". www.cyberscoop.com. Cyberscoop. from the original on May 7, 2021. Retrieved October 16, 2020.
14. Lyngaas, Sean (October 16, 2020). "Google offers details on Chinese hacking group that targeted Biden campaign". Cyberscoop. from the original on May 7, 2021. Retrieved October 16, 2020.
15. "How Microsoft names threat actors". Microsoft. January 16, 2024. Retrieved January 21, 2024.
16. . FireEye. October 16, 2019. Archived from the original on May 7, 2021. Retrieved April 14, 2020.
17. "Bureau names ransomware culprits". www.taipeitimes.com. Taipei Times. May 17, 2020. from the original on March 22, 2021. Retrieved May 22, 2020.
18. Tartare, Mathieu; Smolár, Martin (May 21, 2020). "No "Game over" for the Winnti Group". www.welivesecurity.com. We Live Security. from the original on March 22, 2021. Retrieved May 22, 2020.
19. Greenberg, Andy (August 6, 2020). "Chinese Hackers Have Pillaged Taiwan's Semiconductor Industry". Wired. from the original on March 22, 2021. Retrieved August 7, 2020.
20. Sabin, Sam (October 26, 2022). "New pro-China disinformation campaign targets 2022 elections: Report". Axios. from the original on October 26, 2022. Retrieved October 27, 2022.
21. Naraine, Ryan (March 2, 2021). "Microsoft: Multiple Exchange Server Zero-Days Under Attack by Chinese Hacking Group". securityweek.com. Wired Business Media. from the original on July 6, 2023. Retrieved March 3, 2021.
22. Burt, Tom (March 2, 2021). "New nation-state cyberattacks". blogs.microsoft.com. Microsoft. from the original on March 2, 2021. Retrieved March 3, 2021.
23. Nichols, Shaun (October 20, 2021). "'LightBasin' hackers spent 5 years hiding on telco networks". TechTarget. from the original on November 29, 2023. Retrieved April 8, 2022.
24. Ilascu, Ionut (October 19, 2021). "LightBasin hacking group breaches 13 global telecoms in two years". Bleeping Computer. from the original on July 24, 2023. Retrieved April 8, 2022.
25. Chen, Joey (May 12, 2020). "Tropic Trooper's Back: USBferry Attack Targets Air-gapped Environments". blog.trendmicro.com. Trend Micro. from the original on March 22, 2021. Retrieved May 16, 2020.
26. Cimpanu, Catalin. "Hackers target the air-gapped networks of the Taiwanese and Philippine military". ZDnet. from the original on March 22, 2021. Retrieved May 16, 2020.
27. Intelligence, Microsoft Threat (May 24, 2023). "Volt Typhoon targets US critical infrastructure with living-off-the-land techniques". Microsoft Security Blog. from the original on January 17, 2024. Retrieved May 26, 2023.
28. "George Brandis briefed by ASIO on claims China stole classified blueprints of Canberra headquarters". ABC News. May 29, 2013. from the original on May 30, 2013. Retrieved May 29, 2013.
29. Evans, Jake (May 24, 2023). "Australia joins intelligence partners to blame China for US infrastructure cyber attack". ABC News. from the original on January 12, 2024. Retrieved January 12, 2024.
30. "Foreign hackers attack Canadian government". CBC. February 16, 2011. from the original on February 18, 2011. Retrieved February 17, 2011.
31. "Chinese cyberattack hits Canada's National Research Council". CBC. July 29, 2014. from the original on July 29, 2014. Retrieved July 29, 2014.
32. Boynton, Sean (May 24, 2023). "A Chinese cyber espionage operation is hitting U.S. infrastructure, West warns". Global News. from the original on January 12, 2024. Retrieved January 12, 2024.
33. . The Times of India. India. May 5, 2008. Archived from the original on August 26, 2011. Retrieved October 25, 2010.
34. "'നിശബ്ദ യുദ്ധ'ത്തിന് പിന്നിൽ ചൈന; ടാർഗറ്റ് ഇന്ത്യയും അമേരിക്കയും". ManoramaOnline. from the original on June 6, 2018. Retrieved June 6, 2018.
35. Rising, David (April 7, 2022). "Chinese hackers reportedly target India's power grid". Associated Press. from the original on April 10, 2022. Retrieved April 10, 2022.
36. "Chinese military seen behind Japan cyberattacks". The Japan Times. April 20, 2021. from the original on April 23, 2021. Retrieved April 23, 2021.
37. "Chinese spies hacked Dutch defence network last year - intelligence agencies". Reuters. February 6, 2024. Retrieved February 6, 2024.
38. Ensor, Jamie (May 25, 2023). "New Zealand, Five Eyes issue alert warning of China state actor engaging in 'malicious cyber activity'". Newshub. from the original on January 12, 2024. Retrieved January 12, 2024.
39. Claburn, Thomas. . InformationWeek. Archived from the original on February 27, 2010. Retrieved November 1, 2010.
40. Cha, Ariana Eunjung and Ellen Nakashima, "Google China cyberattack part of vast espionage campaign, experts say". The Washington Post. January 14, 2010.
41. McMillan, Robert (October 23, 2009). "Report Says China Ready for Cyber-war, Espionage". PC World. from the original on April 2, 2010. Retrieved November 1, 2010.
42. Gorman, Siobhan (April 9, 2009). "Electricity Grid in U.S. Penetrated By Spies". Wall Street Journal. ISSN 0099-9660. from the original on June 25, 2018. Retrieved April 1, 2022.
43. "Google cyber attack hit password system" The New York Times, Reuters, April 19, 2010.
44. Goodin, Dan (May 21, 2013). "Chinese hackers who breached Google reportedly targeted classified data". Ars Technica. from the original on November 8, 2014. Retrieved November 8, 2014.
45. Jacobs, Andrew; Helft, Miguel (January 12, 2010). "Google, Citing Attack, Threatens to Exit China". The New York Times. from the original on March 17, 2014. Retrieved November 1, 2010.
46. Zetter, Kim (January 13, 2010). . Wired. Archived from the original on September 18, 2010. Retrieved November 1, 2010.
47. "US embassy cables: China uses access to Microsoft source code to help plot cyber warfare, US fears". The Guardian. London. December 4, 2010. from the original on October 8, 2014. Retrieved December 31, 2010.
48. Riley, Michael, and Dune Lawrence, "Hackers Linked to China's Army Seen From EU to D.C. January 11, 2015, at the Wayback Machine", Bloomberg L.P., 27 July 2012
49. . BusinessWeek. April 10, 2008. Archived from the original on October 25, 2012. Retrieved February 12, 2013.
50. Zetter, Kim (January 25, 2010). "China Accuses US of Cyberwarfare". Wired. from the original on December 28, 2010. Retrieved October 23, 2010.
51. Nakashima, Ellen, "Report on 'Operation Shady RAT' identifies widespread cyber-spying April 24, 2020, at the Wayback Machine", The Washington Post, August 3, 2011.
52. Anderlini, Jamil (January 15, 2010). "The Chinese dissident's 'unknown visitors'". Financial Times. from the original on September 10, 2010. Retrieved August 3, 2011.
53. Barnes, Julian E. (March 4, 2008). . Los Angeles Times. Archived from the original on March 10, 2008. Retrieved March 4, 2008.
54. Brookes, Peter (March 13, 2008). . Family Security Matters. Archived from the original on March 29, 2008. Retrieved April 7, 2008.
55. "The U.S. Presses on Cyberthreats; In Beijing, Treasury Secretary Frames Issue as a Top Priority in Ties With China". May 18, 2017, at the Wayback Machine March 20, 2013 The Wall Street Journal
56. Finkle, J., Menn, J., Viswanatha, J. "U.S. accuses China of cyber spying on American companies". October 6, 2014, at the Wayback Machine Reuters, May 19, 2014.
57. Clayton, M. "US indicts five in China's secret 'Unit 61398' for cyber-spying". May 20, 2014, at the Wayback Machine Christian Science Monitor, May 19, 2014
58. Chinese hacked U.S. military contractors, Senate panel finds March 22, 2018, at the Wayback Machine September 18, 2014 Reuters
59. FBI warns U.S. businesses of cyber attacks, blames Beijing March 22, 2018, at the Wayback Machine October 16, 2014 Reuters
60. Peterson, Andrea (September 24, 2015). "OPM says 5.6 million fingerprints stolen in the biggest cyber attack in US history. America doesn't have anything together this is why this happened". Independent. from the original on September 15, 2017. Retrieved August 26, 2017.
61. Sanders, Sam (June 4, 2015). "Massive Data Breach Puts 4 Million Federal Employees' Records At Risk". NPR. from the original on June 5, 2015. Retrieved April 5, 2018.
62. "Hacks of OPM databases compromised 22.1 million people, federal authorities say July 26, 2018, at the Wayback Machine". The Washington Post. July 9, 2015.
63. Gordon Lubold; Dustin Volz (March 12, 2019). "Navy, Industry Partners Are 'Under Cyber Siege' by Chinese Hackers, Review Asserts; Hacking threatens U.S.'s standing as world's leading military power, study says". WSJ.com. from the original on March 13, 2019. Retrieved March 14, 2019.
64. "US charges 4 members of Chinese military with Equifax hack". CNN. February 10, 2020. from the original on February 11, 2020. Retrieved February 10, 2020.
65. "@FBI on Twitter". from the original on August 16, 2020. Retrieved February 11, 2020.
66. "China, Caught Meddling in Past Two US Elections, Claims 'Not Interested' in 2020 Vote". Voice of America. April 30, 2020. from the original on May 18, 2020. Retrieved May 17, 2020.
67. Barnes, Julian E. (March 16, 2021). "Russian Interference in 2020 Included Influencing Trump Associates, Report Says". The New York Times. ISSN 0362-4331. from the original on April 21, 2021. Retrieved April 21, 2021.
68. "Suspected Chinese hackers spied on U.S., European targets". PBS NewsHour. April 20, 2021. from the original on April 21, 2021. Retrieved April 21, 2021.
69. "China-linked hackers used VPN flaw to target U.S. defense industry -researchers". in.finance.yahoo.com. from the original on April 21, 2021. Retrieved April 21, 2021.
70. Miller, Maggie (April 20, 2021). "Multiple agencies breached by hackers using Pulse Secure vulnerabilities". TheHill. from the original on April 21, 2021. Retrieved April 21, 2021.
71. "China-linked hackers used VPN flaw to target U.S. defense industry -researchers". Reuters. April 20, 2021. from the original on April 21, 2021. Retrieved April 21, 2021.
72. Siddiqui, Zeba; Bing, Christopher; Bing, Christopher (May 25, 2023). "Chinese hackers spying on US critical infrastructure, Western intelligence says". Reuters. from the original on May 25, 2023. Retrieved May 25, 2023.
73. Sanger, David E.; Barnes, Julian E. (July 29, 2023). "U.S. Hunts Chinese Malware That Could Disrupt American Military Operations". The New York Times. ISSN 0362-4331. from the original on July 29, 2023. Retrieved July 29, 2023.
74. Nakashima, Ellen; Menn, Joseph (December 12, 2023). "China's cyber army is invading critical U.S. services". The Washington Post. ISSN 0190-8286. from the original on December 13, 2023. Retrieved December 16, 2023.
75. Volz, Dustin (January 31, 2024). "U.S. Disables Chinese Hacking Operation That Targeted Critical Infrastructure". The Wall Street Journal. Retrieved February 6, 2024.
76. Lyngaas, Sean (February 7, 2024). "Chinese hackers have lurked in some US infrastructure systems for 'at least five years' | CNN Politics". CNN. Retrieved February 8, 2024.
77. Greenberg, Andy. . Archived from the original on August 13, 2020. Retrieved August 12, 2020.
78. Tucker, Maxim (April 1, 2022). "China accused of hacking Ukraine days before Russian invasion". The Times. ISSN 0140-0460. Retrieved April 1, 2022.
79. "Mystery of alleged Chinese hack on eve of Ukraine invasion". BBC News. April 7, 2022. Retrieved April 8, 2022.
80. Milmo, Dan (May 25, 2023). "GCHQ warns of fresh threat from Chinese state-sponsored hackers". The Guardian. ISSN 0261-3077. from the original on January 12, 2024. Retrieved January 12, 2024.
81. "The Vatican Is Said to Be Hacked From China Before Talks With Beijing" August 6, 2020, at the Wayback Machine. The New York Times.
82. Wolf, Jim (November 19, 2010). "Pentagon says "aware" of China Internet rerouting". Reuters. from the original on November 23, 2010. Retrieved November 26, 2010.