Czech Government Attributes Foreign Ministry Hack to China

The Czech government on Wednesday said Chinese state hackers stole sensitive declassified information from the republic’s foreign ministry as part of a years-long espionage campaign .

See Also: OnDemand | North Korea’s Secret IT Army and How to Combat It

The Czech Ministry of Foreign Affairs attributed the hack with a “high degree of certainty” to a Chinese nation-state group tracked as APT31. The hacking group targeted the ministry’s unclassified networks beginning in 2022.

Czech Foreign Minister Jan Lipavsky said his office has summoned the Chinese ambassador “to make the Chinese side understand that such activities have serious implications for bilateral relations.”

APT31, also known as Violet Typhoon and Judgment Panda, is a threat group associated with the Chinese Ministry of State Security. The group, which has been active since 2017, is known for carrying out hacking activities in response to geopolitical developments.

“The Government of the Czech Republic strongly condemns this malicious cyber campaign against its critical infrastructure,” the ministry said. “We call on the People’s Republic of China to adhere to norms and principles, to refrain from such attacks and to take all appropriate measures to address this situation.”

Additionally, the European Union and the North Atlantic Treaty Organization condemned the hack, with the organizations calling on China to refrain from malicious cyber activities and to uphold international law.

In recent months, the Chinese group targeted the Inter-Parliamentary Alliance on China, an international pressure group of European lawmakers dedicated to countering Beijing (see: Suspected Chinese Hackers Hacked UK Defense Contractor).

The U.S. Department of Justice in March 2024 indicted seven Chinese nationals accused of working as contractors for a front company used by APT31 (see: US Indicts Accused APT31 Chinese Hackers for Hire).

The Czech government disclosure comes just over a year after it divulged an attack by Unit 26165 of the Russian Main Intelligence Directorate that targeted its critical infrastructure using a Microsoft Outlook zero-day (see: Russian GRU Hackers Compromised German, Czech Targets).