For years, China seemed to operate at the quieter end of the state-sponsored hacking spectrum. While Russia and North Korea carried out hack-and-leak operations, launched massively disruptive cyberattacks, and blurred the line between cybercriminals and intelligence agencies, China quietly focused on more traditional—if prolific—espionage and intellectual property theft. But a collective message today from dozens of countries calls out a shift in China’s online behavior—and how its primary cyber-intelligence agency’s trail of chaos increasingly rivals that of the Kim Regime or the Kremlin.
On Monday, the White House joined the UK government, the EU, NATO, and governments from Japan to Norway in announcements that spotlighted a string of Chinese hacking operations, and the US Department of Justice separately indicted four Chinese hackers, three of whom are believed to be officers of China’s Ministry of State Security or MSS. The White House statement casts blame specifically on China’s MSS for a mass-hacking campaign that used a vulnerability in Microsoft’s Exchange Server software to compromise thousands of organizations around the world. It also rebukes China’s MSS for partnering with contract organizations that engaged in for-profit cybercrime, turning a blind eye to or even condoning extracurricular activities like infecting victims with ransomware, using victim machines for cryptocurrency mining, and financial theft. “The PRC’s unwillingness to address criminal activity by contract hackers harms governments, businesses, and critical infrastructure operators through billions of dollars in lost intellectual property, proprietary information, ransom payments, and mitigation efforts,” the statement reads.
That long list of digital sins represents a significant shift in Chinese hackers’ modus operandi, much of which China watchers say can be traced back to the country’s 2015 reorganization of its cyber operations. That’s when it transferred much of the control from the People’s Liberation Army to the MSS, a state security service that has over time become more aggressive both in its hacking ambitions and in its willingness to outsource to criminals.
“They go bigger. The number of hacks went down but the scale went up,” says Adam Segal, the director of the Digital and Cyberspace Policy program at the Council on Foreign Relations, who has long focused on China’s hacking activities. That’s in no small part because the non-government hackers that the MSS works with don’t necessarily obey the norms of state-sponsored hacking. “There does seem to be kind of greater tolerance of irresponsibility,” Segal says.
The MSS has always preferred using intermediaries, front companies, and contractors to its own hands-on operations, says Priscilla Moriuchi, a non-resident Fellow at Harvard’s Belfer Center for Science and International Affairs. “This model in both HUMINT and cyber operations allows the MSS to maintain plausible deniability and create networks of recruited individuals & organizations that can bear the brunt of the blame when caught,” says Moriuchi, using the term HUMINT to mean the human, non-cyber side of spying operations. “These organizations can be quickly burned and new ones established as necessary.”
While those contractors offer the Chinese government a layer of deniability and efficiency, though, they also lead to less control of operators, and less assurance that the hackers won’t use their privileges to enrich themselves on the side—or the MSS officers who dole out the contracts. “In light of this model, it is not surprising to me at all that MSS-attributed cyber operations groups are also conducting cybercrime,” Moriuchi adds.
The White House statement as a whole points to a broad, messy and in some cases unrelated collection of Chinese hacking activity. A separate indictment names four MSS-affiliated hackers, three of whom were MSS officers, all accused of a broad range of intrusions targeting industries around the world from health care to aviation.
But more unusual than the data theft outlined in that indictment was the mass-hacking called out in Monday’s announcement, in which a group known as Hafnium—now linked by the White House to China’s MSS—broke into no fewer than 30,000 Exchange Servers around the world. The hackers also left behind so-called “web shells,” allowing them to regain access to those servers at will but also introducing the risk that other hackers might discover those backdoors and exploit them for their own purposes. That element of the hacking campaign was “untargeted, reckless, and extremely dangerous,” wrote former CrowdStrike CTO and founder of Silverado Policy Accelerator Dmitri Alperovitch, along with researcher Ian Ward, in a March blog post. At least one ransomware group appeared to try to piggyback off of Hafnium’s campaign soon after it was exposed.
There’s no clear evidence that the MSS’s Hafnium hackers themselves deployed ransomware or cryptocurrency mining software on any of those tens of thousands of networks, according to Ben Read, the director of cyber-espionage analysis at incident response and threat intelligence firm Mandiant. Instead, the White House’s criticism of China’s government for blurring cybercrime and cyberspying seems to be related to other, years-long hacking campaigns that more clearly crossed that line. In September of last year, for instance, the DOJ indicted five Chinese men who worked for an MSS contractor known as Chengdu 404 Network Technology—known in the cybersecurity industry by the name Barium before they were identified—all of whom stand accused of hacking dozens of companies around the world in a collection of operations that seemed to liberally mix espionage with for-profit cybercrime.