Australia joins international community in blaming China for large scale Microsoft hack

Australia has joined the United States and other allies in accusing China of engaging in “malicious cyber activities”, including a massive global hack on the Microsoft Exchange software that compromised tens of thousands of computers earlier this year.

In a joint statement, the Ministers for Home Affairs Karen Andrews, Foreign Affairs Marise Payne and Defence Peter Dutton also expressed serious concern about China’s reported use of criminal hackers.

“The Australian Government is seriously concerned about reports from our international partners that China’s Ministry of State Security is engaging contract hackers who have carried out cyber-enabled intellectual property theft for personal gain and to provide commercial advantage to the Chinese Government,” the statement said.

“Australia calls on all countries – including China – to act responsibly in cyberspace.”

The Microsoft Exchange hack was first identified in January and was rapidly attributed to Chinese cyber spies by private sector groups.

But it has taken until now for Australia, and like-minded countries, to publicly attribute the cyber attack to Beijing.

“These actions have undermined international stability and security by opening the door to a range of other actors, including cyber criminals, who continue to exploit this vulnerability for illicit gain,” the Australian government said in a statement.

The United States said it was joining other nations in “holding the People’s Republic of China accountable” for what it described as a “pattern of irresponsible, disruptive, and destabilising behaviour in cyberspace”.

“The United States government … has formally confirmed that cyber actors affiliated with the MSS (China’s Ministry of State Security) exploited vulnerabilities in Microsoft Exchange Server in a massive cyber espionage operation that indiscriminately compromised thousands of computers and networks, mostly belonging to private sector victims,” Secretary of State Antony Blinken said in a statement.

“Responsible states do not indiscriminately compromise global network security nor knowingly harbour cyber criminals — let alone sponsor or collaborate with them.

“These contract hackers cost governments and businesses billions of dollars in stolen intellectual property, ransom payments, and cybersecurity mitigation efforts, all while the MSS had them on its payroll.”

UK Foreign Minister Dominic Raab said Chinese state-backed groups were responsible for “a pervasive pattern of hacking”.

“The cyber attack on Microsoft Exchange Server by Chinese state-backed groups was a reckless but familiar pattern of behaviour,” Mr Raab said in a statement.

“The Chinese Government must end this systematic cyber sabotage and can expect to be held account if it does not.”

The European Union also blamed China for what it said were malicious cyber activities with “significant effects” that targeted government institutions and political organisations in the EU and its 27 member states, as well as key European industries.

In a statement, the EU’s foreign policy chief Josep Borrell said the hacking was “conducted from the territory of China for the purpose of intellectual property theft and espionage”.

Since 2017, the Morrison government said Australia had publicly attributed malicious cyber activity to North Korea, Russia, China and Iran.