US government emails hacked by suspected Chinese agents

Hack is seen as part of a suspected cyber-espionage campaign to access data in sensitive computer networks.

Microsoft said hackers took advantage of a security weakness in its cloud-computing environment that has now been mitigated. Picture: Reuters

Hackers linked to China breached email accounts at more than two dozen organisations including some US government agencies, officials and Microsoft researchers said, in what was part of a suspected cyber-espionage campaign to access data in sensitive computer networks.

The new penetration has prompted alarm among some officials and security researchers and is being viewed as part of an espionage campaign that potentially compromised valuable information belonging to the US government, according to people familiar with the matter.

Senior Western intelligence officials have grown increasingly worried in recent years about the ability of Chinese hackers to orchestrate especially impressive and stealthy attacks that in some cases have been able to evade detection for years.

“Last month, US government safeguards identified an intrusion in Microsoft’s cloud ­security, which affected unclassified systems. Officials immediately contacted Microsoft to find the source and vulnerability in their cloud service,” Adam Hodge, spokesman for the White House National Security Council, said. “We continue to hold the procurement providers of the US government to a high security threshold.”

The full scope and severity of the incident, and which institutions and individuals were hacked, couldn’t be learned late on Tuesday.

China has routinely denied hacking US organisations and has accused Washington and its allies of targeting Chinese ­networks.

The hackers, dubbed Storm-0558 by Microsoft, broke into email accounts at about 25 organisations and hit consumer accounts that were likely linked to these entities, Microsoft said in a blog post published late on Tuesday. The hackers took advantage of a security weakness in Microsoft’s cloud-computing environment that has now been mitigated, the company said.

The hackers gained access to victims’ email beginning on May 15 and operated in stealth for more than a month.

US cyber investigators within the Biden administration were still working to determine the potential severity of the hacking campaign. While significant, it appeared to be far narrower – and more targeted – than a Russian intelligence operation discovered in 2020 that weaponised software from a US company called SolarWinds to breach a wide raft of federal agencies and corporate networks, a person familiar with the matter said. Still, the incident was serious enough to trigger a recent briefing for congressional staff by the Biden administration.

The Biden administration has been working to ease tensions with Beijing following a series of confrontations in recent months, including over Taiwan, the Ukraine war, the US discovery and shooting down of a Chinese surveillance balloon and revelations of increased Chinese intelligence co-operation with Cuba. Treasury Secretary Janet Yellen’s visit to China last week to discuss economic relations was the second by a top Biden administration cabinet member in less than a month, following Secretary of State Antony Blinken’s trip there in June.

Over the past year, China-linked hackers have displayed a new level of ingenuity in targeting widely used devices from well-known brands on the edge of corporate networks to get a foothold, according to researchers at Google, a part of Alphabet.

“We’re seeing some new victims; we’re seeing the exploitation of different technologies,” said Charles Carmakal, chief technology officer with Google’s Mandiant group.

The hackers in the latest attack gained access to email systems without authorisation by forging digital tokens, used to authenticate users on the internet, Microsoft said.

Based on Microsoft’s description of the hack, the technique appears to have been “very advanced,” Mr Carmakal said.

“When you use something like this on individuals, they are probably very high-value ­targets.”

The Wall Street Journal