Australia has joined with the US and other allies to blame China for a massive cyberattack – and issue a stark warning.
Australia has joined with the United States and other allied nations to condemn China’s “malicious cyber activities”, directly blaming it for a massive hack of Microsoft Exchange software earlier this year.
In a joint statement on Monday night, Foreign Minister Marise Payne, Home Affairs Minister Karen Andrews and Defence Minister Peter Dutton said China’s actions in cyberspace had “undermined international stability and security”.
They said the Australian government was “seriously concerned” about reports from allies that China’s Ministry of State Security (MSS) was “engaging contract hackers” to steal intellectual property from other countries.
“Australia calls on all countries, including China, to act responsibly in cyberspace,” said Ms Payne, Ms Andrews and Mr Dutton.
“China must adhere to the commitments it has made in the G20, and bilaterally, to refrain from cyber-enabled theft of intellectual property, trade secrets and confidential business information with the intent of obtaining competitive advantage.”
They said Australia’s cyber security posture was “strong”, but there was “no room for complacency” and the government would continue to work with its international partners to strengthen security.
RELATED: China’s misinformation war against Australia
The Microsoft Exchange hack, first identified in January, compromised tens of thousands of computers around the world. Private sector groups quickly pointed the finger at China, though it had not been publicly accused by governments until now.
The Australian ministers’ joint statement was released in co-ordination with the US, United Kingdom, European Union and NATO.
US Secretary of State Antony Blinken said China was being held accountable for a “pattern of irresponsible, disruptive and destabilising behaviour in cyberspace”.
“China’s Ministry of State Security has fostered an ecosystem of criminal contract hackers who carry out both state-sponsored activities and cybercrime for their own financial gain,” said Mr Blinken.
“In addition, the US government alongside our allies and partners has formally confirmed that cyber actors affiliated with the MSS exploited vulnerabilities in Microsoft Exchange Server in a massive cyber espionage operation that indiscriminately compromised thousands of computers and networks, mostly belonging to private sector victims.
“As evidenced by the indictment of three MSS officers and one of their contract hackers unsealed by the Department of Justice today, the US will impose consequences on Chinese malicious cyber actors for their irresponsible behaviour in cyberspace.”
Mr Blinken said the international community had laid out clear expectations and guidelines for what constitutes “responsible behaviour” in cyberspace.
“Responsible states do not indiscriminately compromise global network security nor knowingly harbour cyber criminals, let alone sponsor and collaborate with them,” he said.
“These contract hackers cost governments and businesses billions of dollars in stolen intellectual property, ransom payments and cybersecurity mitigation efforts, all while the MSS had them on its payroll.”
He added that the US and its allies would work together to oppose “digital authoritarianism”, and “enhance global security and stability” in cyberspace.
RELATED: China builds new Great Wall as conflict escalates
The indictment Mr Blinken mentioned concerns four Chinese nationals working with the MSS. A grand jury in San Diego has charged each of them with conspiracy to commit computer fraud and conspiracy to commit economic espionage, which carry a maximum combined prison sentence of 20 years.
They were allegedly part of a “worldwide hacking and economic espionage campaign” to hack into the computer systems of dozens of companies, universities and government entities in the US and elsewhere between 2011 and 2018.
The cyberattacks were focused on stealing information “of significant economic benefit to China’s companies and commercial sectors”, including information that would allow them to circumvent “resource-intensive research and development processes”.
“These charges once again highlight that China continues to use cyber-enabled attacks to steal what other countries make, in flagrant disregard of its bilateral and multilateral commitments,” said Deputy Attorney General Lisa Monaco.
“The breadth and duration of China’s hacking campaigns, including these efforts targeting a dozen countries across sectors ranging from healthcare and biomedical research to aviation and defence, remind us that no country or industry is safe.”
FBI Deputy Director Paul Abbate said the US would not allow the Chinese government to “obtain unfair economic advantage” through “criminal intrusion and theft”.
RELATED: China threatens to nuke Japan if it interferes
British Foreign Minister Dominic Raab described a “pervasive pattern of hacking” from China, saying the Microsoft Exchange cyberattack was “reckless” but “familiar”.
“The Chinese government must end this systematic cyber sabotage and can be expect to be held to account if it does not,” Mr Raab said.
The co-ordinated international effort to apply pressure to China comes in the wake of US President Joe Biden’s summit with Russian President Vladimir Putin last month, where Mr Biden warned Mr Putin he would face “consequences” if cyberattacks continued to be launched from Russia.
Russia has been blamed for a series of ransomware attacks, in which criminals steal companies’ data and then demand payment to return it.
The US imposed sanctions on Russia in response to the hacking in April. It has yet to announce any sanctions against China.
Speaking to reporters at the White House today, Mr Biden suggested that was because the investigation into the Microsoft Exchange hack was still ongoing.