Caracal | Communications for Geopolitics

View Original

The Microsoft Exchange hack: It's a China pile on

Three things corporate communicators need to know:

1. No way Beijing was expecting this multilateral response

When dealing with foreign governments, Beijing's standard operating procedure is to divide and conquer. Beijing prefers to deal with nations one on one and separate the bigs from the smalls.

Today a wave of multilateralism landed at Zhongnanhai, the principal center of government in the People's Republic of China.

The United States, the United Kingdom, and their allies formally attributed the Microsoft Exchange hack to actors affiliated with the Chinese government and accused Beijing's leadership of a broad array of "malicious cyber activities," Bloomberg reports.

The group of nations said that the Chinese government has been the mastermind behind a series of malicious ransomware, data theft, and cyber-espionage attacks against public and private entities, including the sprawling Microsoft Exchange hack earlier this year.

The group of nations attributing the attack to China includes Australia, Canada, New Zealand, Japan, and NATO.

2. NATO calls out Chinese cyber attacks for the first time

NATO's response to the Microsoft Exchange hack marks the first public and formal condemnation by the North American-European alliance on China's cyber activities.

Senator Mitt Romney (R-UT) posted on Twitter: "This isn't just about stolen property—cyberattacks sponsored by the Chinese Communist Party pose a massive threat to our national security and that of our allies. @USNATO is right to accuse China of these attacks. The world must wake up to the threat China poses to global order."

Not only does NATO involvement bring into focus the potential use of Article 5 - said article provides that if a NATO Ally is the victim of an armed attack, each and every other member of the Alliance will consider this act of violence as an armed attack against all members and will take the actions it deems necessary to assist the Ally attacked - but as Senator Romney stated, China's actions and involvement in this hack pose a grave threat to the global order.

This is all to say that these actors affiliated with the Chinese government and supported by Beijing's leadership are not professional. These activities are unseemly for a responsible government, noting that these actions could be seen as an armed attack against all NATO members.

3. The hack was just too big to ignore

The hack targeted Microsoft Exchange servers and is believed to have impacted at least 30,000 organizations globally.

This hack marked a bridge too far in Chinese cyber activity and one which alarmed so many in the West that the only response was a globally united, multilateral, and multi-institutional.

"We believe that cyber-operators working under the control of Chinese intelligence learned about the Microsoft vulnerability in early January, and we're racing to exploit the vulnerability before [it] was widely identified in the public domain," a security source told the BBC.

The BBC reported that if this had been all, it would have been just another espionage operation. But in late February, something significant changed.

The targeted attack became globally massive when other China-based groups began to exploit the vulnerability.

What is seen as pesky spying but acceptable actions by governments, the hack had turned from targeted, state-endorsed espionage to a "massive smash-and-grab raid."

Western security sources believe Chinese agents had obtained advanced knowledge that Microsoft intended to patch or close the vulnerability. Still, the Chinese government decided to use this knowledge and steal and hack as much as possible.

The recklessness of the decision to spread the vulnerability helped drive the decision to call out the Chinese publicly, officials say.

What does this mean:

The United States is formally accusing the Chinese government of leading malicious cyber operations and hiring mercenaries. The claim accuses China of sponsoring espionage and supporting and possibly endorsing the work of cyber criminals executing these attacks.

Governments worldwide are hopeful that this "name and shame" action will push China to act as a responsible global actor, and coordinated international effort will suppress future cyber activities that move beyond espionage norms.


To read the full post, you need to join Carcacal’s China Communications Intelligence service.

Designed by a communication executive for other communication executives, it is the only US-China commercial relationship service that puts communications first.

Carcacal’s China Communications Intelligence service is actionable insights, media trend-spotting, and senior executive advisory to help you better think about and speak on the US-China commercial relationship.