The country’s hackers have gotten far more aggressive since 2015, when the Ministry of State Security largely took over the country’s cyberespionage.
For years, China seemed to operate at the quieter end of the state-sponsored hacking spectrum. While Russia and North Korea carried out hack-and-leak operations, launched massively disruptive cyberattacks, and blurred the line between cybercriminals and intelligence agencies, China quietly focused on more traditional—if prolific—espionage and intellectual property theft. But a collective message today from dozens of countries calls out a shift in China’s online behavior—and how its primary cyber-intelligence agency’s trail of chaos increasingly rivals that of the Kim Regime or the Kremlin.
On Monday, the White House joined the UK government, the EU, NATO, and and governments from Japan to Norway in announcements that spotlighted a string of Chinese hacking operations, and the US Department of Justice separately indicted four Chinese hackers, three of whom are believed to be officers of China’s Ministry of State Security or MSS. The White House statement casts blame specifically on China’s MSS for a mass-hacking campaign that used a vulnerability in Microsoft’s Exchange Server software to compromise thousands of organizations around the world. It also rebukes China’s MSS for partnering with contract organizations that engaged in for-profit cybercrime, turning a blind eye to or even condoning extracurricular activities like infecting victims with ransomware, using victim machines for cryptocurrency mining, and financial theft. The PRC’s unwillingness to address criminal activity by contract hackers harms governments, businesses, and critical infrastructure operators through billions of dollars in lost intellectual property, proprietary information, ransom payments, and mitigation efforts, the statement reads.
That long list of digital sins represents a significant shift in Chinese hackers’ modus operandi, much of which China watchers say can be traced back to the country’s 2015 reorganization of its cyber operations. That’s when it transferred much of the control from the People’s Liberation Army to the MSS, a state security service that has over time become more aggressive both in its hacking ambitions and in its willingness to outsource to criminals.