Chinese Hackers Raided US Government Email Accounts

A reliable source has revealed that a Chinese group, recognized by Microsoft, recently launched a cyber attack on the email accounts of important American officials, such as the Commerce Secretary, Gina Raimondo. The consequences of this theft are still unfolding and are affecting a larger number of people as time goes on.

On July 12, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) jointly released a cybersecurity advisory, sharing the information with the public. As stated by the authorities, "In June 2023, a Federal Civilian Executive Branch (FCEB) agency detected unusual activity within their Microsoft 365 (M365) cloud environment. Upon investigation, Microsoft confirmed that sophisticated and persistent threat actors successfully infiltrated and extracted non-classified Exchange Online Outlook data."

Microsoft conducted an investigation and discovered that a hacking group called Storm-0558, operating from China and known for being highly skilled, successfully hacked into email accounts using Outlook Web Access in Exchange Online (OWA) and Outlook.com. They achieved this by tricking the system with fake authentication tokens to gain unauthorized access.

As reported by The Washington Post, the U.S. government took the initiative to inform Microsoft about the security loophole. "Upon discovering the source and vulnerability within their cloud service, officials promptly reached out to Microsoft," stated National Security Council spokesperson Adam Hodges in the publication. He further emphasized, "We maintain stringent security standards for the procurement providers serving the U.S. government."

Gina Raimondo, who has been openly critical of Beijing, was one of the people targeted in the cyber attack. She has been working on tightening export regulations with China and warning against supplying U.S. semiconductor technology to Russia if they obtain chips from China. It is expected that Ms. Raimondo will be visiting China officially before the end of the summer.

The Cybersecurity and Infrastructure Security Agency confirmed that the hackers focused on a limited number of email accounts within each organization rather than executing a widespread intrusion. The precise number of compromised accounts remains undisclosed by both U.S. officials and Microsoft.

While the U.S. government has not officially blamed China for the attack, private U.S. officials believe it aligns with Microsoft's assessment and is likely a sophisticated operation supported by the Chinese government. The reason for not making a formal attribution could be the Biden administration's desire to continue ongoing discussions with Beijing.