Chinese groups accused of hacking Microsoft and the U.S.

Chinese Hacking Teams Accused of Digital Intrusion Campaigns

Chinese hacking teams have been blamed by Western intelligence agencies and cybersecurity groups for digital intrusion campaigns across the world, targeting everything from government and military organisations to corporations and media groups.

Cybersecurity firms believe many of those groups are backed by China’s government. U.S.-based Mandiant has said some Chinese hacking groups are operated by units of China’s army.

China’s authorities have consistently denied any form of state-sponsored hacking, saying China itself is a frequent target of cyberattacks. It has dubbed the U.S. National Security Agency (NSA) as “the world’s largest hacker organisation”.

Chinese Hacking Teams Identified by Intelligence Agencies and Cybersecurity Groups

• Volt Typhoon: Western intelligence agencies and Microsoft said on May 24 that Volt Typhoon, a group they described as state-sponsored, had been spying on a range of U.S. critical infrastructure organisations, from telecommunications to transportation hubs. China’s foreign ministry described the reports as part of a U.S. disinformation campaign.
• BackdoorDiplomacy: Palo Alto Networks, a U.S. cybersecurity firm, says its research showed BackdoorDiplomacy has links to the Chinese state and is part of the APT15 hacking group. A Reuters report in May identified BackdoorDiplomacy as being behind a widespread series of digital intrusions over several years against key Kenyan ministries and state institutions. The Chinese authorities said it was not aware of such hacking and described the accusations as baseless.
• APT 41: Chinese hacking team APT 41, which is also known as Wintti, Double Dragon and Amoeba, has conducted a mix of government-backed cyber intrusions and financially motivated data breaches, according to U.S.-based cybersecurity firms FireEye and Mandiant. The U.S secret service said the team had stolen U.S. COVID relief benefits worth tens of millions of dollars between 2020-2022. Taiwan-based cybersecurity firm TeamT5 said the group had targeted government, telecoms, and media victims in Japan, Taiwan, Korea, the United States and Hong Kong. APT 41 was named by the U.S Department Justice in September 2020 in relation to charges brought against seven hackers for allegedly compromising more than 100 companies around the world. The Chinese authorities have described such reports as “groundless accusations”.
• APT 27: Western intelligence agencies and cybersecurity researchers say Chinese hacking team APT 27 is sponsored by the state and has launched multiple attacks on Western and Taiwanese government agencies. APT 27 claimed responsibility for cyber attacks against Taiwan in 2022 during a visit by then U.S House of Representatives Speaker Nancy Pelosi, saying it acted as a protest because Pelosi defied China’s warnings not to visit. Cybersecurity firm Mandiant said last year the group compromised the computer networks of at least six U.S. state governments between May 2021 and February of 2022, while the German authorities named blamed it for attacks against German pharmaceuticals, technology and other companies.

(Reporting by Fanny Potkin; Editing by James Pearson and Edmund Blair)