Chinese hackers breached State, Commerce Depts, Microsoft and US say

Chinese hackers breached State, Commerce Depts, Microsoft and US say
Russia continues to access foreign chips and technology through intermediaries like Iran, a senior US official responsible for regulating exports said. (Image: Adobe Stock)

WASHINGTON/LONDON, July 12 (Reuters) - Chinese state-linked hackers since May have secretly accessed email accounts at around 25 organisations, including at least two US government agencies, Microsoft MSFT.O and US officials said on Wednesday.

By James Pearson and Christopher Bing

The United States detected a breach of federal government accounts “fairly rapidly” and managed to prevent further breaches, White House national security adviser Jake Sullivan said in an interview with ABC’s “Good Morning America” program.

The U.S. State and Commerce Departments said in statements that they were among the affected agencies.

The email accounts of Secretary of Commerce Gina Raimondo and Department of State officials were also hacked, The Washington Post reported, citing U.S. officials familiar with the matter.

Raimondo is the only known Cabinet-level official to have their account breached in the incident.

A senior U.S. government official told reporters it would be unfair to compare it to the SolarWinds compromise, a sweeping set of digital break-ins that were disclosed in late 2020 and blamed on Russian cyberspies.

“This intrusion should not be compared to SolarWinds,” the official said, calling the recently discovered campaign “much narrower.”

The U.S. official said he could not comment on Microsoft’s decision to attribute the hack to China.

Microsoft said in a statement that the hacking group – which it dubbed Storm-0558 – forged digital authentication tokens to access webmail accounts running on the firm’s Outlook service. The activity began in May, Microsoft said.

“As with any observed nation-state actor activity, Microsoft has contacted all targeted or compromised organizations directly via their tenant admins and provided them with important information to help them investigate and respond,” the company added.

Microsoft did not say which organizations or governments had been affected, but added that the hacking group involved primarily targets entities in Western Europe.

China’s embassy in London called the accusation “disinformation” and called the U.S. government “the world’s biggest hacking empire and global cyber thief.” China routinely denies involvement in hacking operations regardless of the available evidence or context.

White House National Security Council spokesman Adam Hodge said an intrusion in Microsoft’s cloud security “affected unclassified systems,” without elaborating.

“Officials immediately contacted Microsoft to find the source and vulnerability in their cloud service,” Hodge added.

The State Department “detected anomalous activity” and “took immediate steps to secure our systems,” a department spokesperson said in a statement. The Commerce Department said it took “immediate action” after Microsoft notified it of a compromise.

Private sector cybersecurity experts have said newly discovered hacking activity shows how Chinese groups are improving their cyber capabilities.

“Chinese cyber espionage has come a long way from the smash-and-grab tactics many of us are familiar with,” said John Hultquist, chief analyst for U.S. cybersecurity firm Mandiant.


(Editing by Alistair Bell and Diane Craft)


Comments - Please in order to comment.

Please peer review 3 community comments before your comment can be posted

[%% img-description %%]

The Spy Bill: An autocratic roadmap to State Capture 2.0

Join Heidi Swart in conversation with Anton Harber and Marianne Merten as they discuss a concerning push to pass a controversial “Spy Bill” into law by May 2024. Tues 5 Dec at 12pm, live, online and free of charge.

A South African Hero: You

There’s a 99.8% chance that this isn’t for you. Only 0.2% of our readers have responded to this call for action.

Those 0.2% of our readers are our hidden heroes, who are fuelling our work and impacting the lives of every South African in doing so. They’re the people who contribute to keep Daily Maverick free for all, including you.

The equation is quite simple: the more members we have, the more reporting and investigations we can do, and the greater the impact on the country.

Be part of that 0.2%. Be a Maverick. Be a Maverick Insider.

Support Daily Maverick→
Payment options