Big Cyberespionage Attack Against Japan Attributed to China

Classified military networks run by Japan reportedly suffered a massive breach in 2020 at the hands of a Chinese cyberespionage group that proved tough to eject even after being discovered.

See Also: Live Webinar | Unmasking Pegasus: Understand the Threat & Strengthen Your Digital Defense

Hackers accessed Ministry of Defense plans as well as information about military capabilities and shortcomings, unnamed senior U.S. officials told The Washington Post.

In a Monday report that reveals the breach publicly for the first time, the newspaper reported that the network penetration was so serious that both Army Gen. Paul Nakasone, who heads the National Security Agency and U.S. Cyber Command, and Matthew Pottinger, who was then the White House deputy national security adviser, “raced to Tokyo” to brief the defense minister.

The Japanese government said it could not confirm if confidential information had been leaked due to the intrusion, Japanese Chief Cabinet Secretary Hirokazu Matsuno said at a regularly scheduled press briefing on Tuesday.

Matsuno said there continues to be “close collaboration between Japan and the United States” on cybersecurity matters.

Speaking on background, U.S. defense officials told the Post that in 2021, the White House didn’t think Japan was doing enough to seal its networks against Chinese hackers. They said while Tokyo has made notable strides since, shortcomings continue and could imperil intelligence sharing between the Pentagon and Japan’s Defense Ministry at a time when the rising threat posed by China demands even closer collaboration.

Top National Security Threat

U.S. government networks haven’t been immune to attacks attributed to Chinese espionage groups.

“China probably currently represents the broadest, most active and persistent cyberespionage threat to U.S. government and private sector networks,” said the most recent annual report of worldwide threats to the national security of the United States, published by the Office of the Director of National Intelligence.

In May, cybersecurity experts said, a Chinese espionage group given the codename Storm-0558 by Microsoft began using forged tokens to gain access to Exchange and Outlook email accounts hosted online by Microsoft for 25 different organizations worldwide. Victims of the attack campaign, which wasn’t discovered until last month, included Western European governments as well as the U.S. Commerce and State departments, including the U.S. ambassador to China.

These are far from the first technically sophisticated online attacks to have been attributed to China. Last October, hackers began targeting a zero-day vulnerability in Barracuda Email Security Gateway, designated as CVE-2023-2868.

The ESG-targeting attack campaign wasn’t discovered by Barracuda until May 19, at which point it brought in Google’s Mandiant incident response group to investigate (see: Hackers Exploited Zero-Day Bug for 8 Months, Barracuda Warns).

On Saturday, public broadcaster Japan Broadcasting Corp., known as NHK, first reported that the Japanese Cabinet Secretariat’s Cybersecurity Center, which sets the country’s cybersecurity policy, had been among the victims of the Barracuda ESG campaign.

Mandiant reported that it has “high confidence” that the group of attackers, which it now tracks as UNC4841, “is an espionage actor behind this wide-ranging campaign in support of the People’s Republic of China.”

Eradicating hackers from networks where they have gained a foothold has proven to be extremely challenging. “Following Barracuda’s vulnerability disclosure and initial remediation actions, UNC4841 countered by moving rapidly to alter its malware, employ additional persistence mechanisms, and move laterally in an attempt to maintain access to compromised environments,” Mandiant reported.

“This actor is characteristic of the changing nature of Chinese cyberespionage,” said John Hultquist, chief analyst at Google Cloud’s Mandiant incident response group. “Their activity has grown from loud, easily detected operations to careful and stealthy intrusions which will challenge even the most sophisticated security teams.”