US officials say hackers linked to the Chinese government are responsible for breaching security at major telecommunications companies and US agencies.
The latest hack, announced on Monday, targeted the US Department of the Treasury, which called the infiltration a “major incident”.
Officials said the hackers were able to access employee workstations and some unclassified documents. China denies involvement.
It’s the latest in a string of cyber-attacks that have emerged in recent months against US and other Western targets.
What’s been hacked?
The treasury department hack followed news in late October that the two major US presidential campaigns were targeted.
The FBI and the Cybersecurity and Infrastructure Security Agency (Cisa) said the hack targeting the White House campaigns was carried out “by actors affiliated with the People’s Republic of China”.
In September, reports surfaced of an operation that managed to breach security at top telecommunications firms.
The White House recently said at least nine companies were hacked, including telecoms giants AT&T and Verizon.
And earlier in the year, in March, seven Chinese nationals were charged with running a hacking operation that lasted at least 14 years and targeted foreign critics of China, businesses and politicians.
Operations linked by Western governments to China have also targeted the UK’s Electoral Commission, and the UK and New Zealand parliaments.
Who are the hackers?
While full details have yet to be revealed, the hacks appear to be the work of several different units – each, US authorities say, linked to the Chinese state.
The hacking groups are given nicknames by security firms. For instance the group behind the telecoms hack is most commonly known by Salt Typhoon, the name given to it by researchers at Microsoft. Other firms have dubbed it Famous Sparrow, Ghost Emperor and Earth Estrie.
Salt Typhoon is thought to be behind the telecoms hack. A separate group, nicknamed Volt Typhoon, has been accused of breaking into critical infrastructure organisations for potential disruption attacks.
The seven Chinese citizens charged with hacking were linked by US justice department officials to an operation known as Zirconium or Judgment Panda.
The UK’s National Cyber Security Centre says the same operation targeted UK parliamentarians’ emails in 2021.
