US and UK Formally Blame Chinese State-Sponsored Hackers for MS Exchange Server Attacks
The UK formally laid the blame for the cyber attacks executed through abusing Microsoft Exchange Server vulnerabilities earlier this year on Chinese-based, state-sponsored hackers.
The United Kingdom's official government website published a press release on July 19, stating that the country joins other "likeminded partners" and can confirm that the hacker attacks executed through MS Exchange Server have been the work of "state-backed" actors based in China.
The cyber attack in question took place in the first few months of 2021. Researchers believe the first attempts to hack servers and exploit the now-patched vulnerabilities took place as early as January 2021. Hackers took advantage of several different vulnerabilities codified as CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065.
The repercussions of those attacks were serious, a staggering number of servers were affected and the security issues associated with the vulnerabilities were very significant.
The UK government stated that the early 2021 attacks were very likely conducted with the purpose of "large-scale espionage" and their goals included the theft of IP and sensitive information. The British government specifically blamed Chinese authorities for supporting the threat groups known by the handles of APT40 and APT31. Those groups are believed to be responsible for attacks against targets in both Europe and the US.
The formal condemnation and statement from the UK comes on the same day when the White House published a press release of its own. The US also spoke out, joining the UK and "allies and partners" to "attribute malicious cyber activity" to the People's Republic of China.
The joined stand that western powers are taking against China in this cybersecurity debacle also includes NATO and the European Union as a whole.
This comes in the wake of a recent phone call that President Biden held with Russian leader Vladimir Putin, concerning what the US believes to be cyber attacks originating from threat actors based in Russia.
The threat actor behind the MS Exchange Server attacks is referred to as Hafnium and has been described by Microsoft as "highly skilled and sophisticated".
