New Zealand’s Government Communications Security Bureau (GCSB) revealed on Monday that Chinese state-sponsored hackers attacked two computer systems used by the New Zealand Parliament in 2021.
GCSB said the hackers managed to access some data on the systems, but nothing of a “strategic or sensitive” nature.
The GCSB is New Zealand’s leading cybersecurity and signals intelligence organization. The agency revealed previously classified details of the 2021 Chinese cyberattack after sister agencies in the United States and United Kingdom disclosed details of similar attacks they have endured.
“This is the first time we have attributed state-sponsored malicious cyber activity to the People’s Republic of China, for intrusion into New Zealand government systems,” GCSB Director Andrew Clark said on Monday.
Clark explained that his agency detected malicious activity in two key computer networks used by Parliament in August 2021. GCSB linked the intrusion to China’s Ministry of State Security (MSS) and one of its many hacker groups, code-named APT40, with a high degree of confidence.
“This link has been reinforced by analysis from international partners of similar events in their own jurisdictions,” Clark said.
APT40 is classified as a Chinese state-linked hacker threat by the U.S. Cybersecurity and Infrastructure Security Agency (CISA). The group operates under various colorful aliases, including Bronze Mohawk, GreenCrash, and Kryptonite Panda.
APT40 has been active since at least 2009, targeting government, corporate, and academic computer systems in the U.S., Canada, Europe, the Middle East, and the South China Sea region. The group has a predilection for attacking industries that might compete with China’s Belt and Road Initiative (BRI). The U.S. Department of Justice (DOJ) indicted four members of APT40 for cyber espionage in July 2021.
The 2021 New Zealand intrusion was described in detail in a statement released by GCSB minister Judith Collins, who condemned China for targeting New Zealand’s Parliament and the UK Electoral Commission with “malicious cyber activity.”
The government of New Zealand summoned Chinese Ambassador Wang Xiaolong to lodge a complaint and ask China to desist from such cyber-espionage in the future. However, New Zealand stopped short of leveling punitive sanctions against Beijing.
“Foreign interference of this nature is unacceptable, and we have urged China to refrain from such activity in future,” said Foreign Minister Winston Peters.
New Zealand Prime Minister Christopher Luxon said his country has a “longstanding, complex relationship with China” and, while he wished to avoid escalating the matter into a major dispute with sanctions, he reserved the right to “call out” Chinese mischief when it was detected.
“We are calling out where we see malicious cyber-activity from any state that attacks our democratic institutions,” Luxon said.
“This is a first for New Zealand: publicly attributing a malicious cyber-activity on our democratic institutions by China. It’s a big step for us,” he added.
China did not take the accusations well. The Chinese embassy in New Zealand rejected GCSB’s “groundless and irresponsible accusations,” and lodged its own “serious démarches to New Zealand’s relevant authorities” to express its “strong dissatisfaction and resolute opposition.”
“We have never, nor will we in the future, interfere in the internal affairs of other countries, including New Zealand,” the Chinese embassy said.
This statement was manifestly false, given the mountain of evidence that China has interfered in the politics of New Zealand, the United Kingdom, the United States, and Taiwan, and shows no sign of halting its malicious activity.
The U.S. and UK on Monday announced criminal charges against seven Chinese nationals for “conspiracy to commit computer intrusions and conspiracy to commit wire fraud.” The defendants are all allegedly members of another Chinese state hacking group known as APT31.
“The Justice Department will not tolerate efforts by the Chinese government to intimidate Americans who serve the public, silence the dissidents who are protected by American laws, or steal from American businesses,” said Attorney General Merrick Garland.
