An unprecedented condemnation of China’s involvement in cyberattacks is ramping up tensions between China and the United States and its allies at a time when these are already high.

Late Monday New Zealand joined the US and many of its partners including Canada, Australia, the EU as well as military alliance the North Atlantic Treaty Organisation (NATO) in blaming Chinese state-sponsored actors for “malicious cyber activity.”

This activity includes a massive Microsoft Exchange hack earlier this year that compromised tens of thousands of computers around the world.

“We call for an end to this type of malicious activity, which undermines global stability and security, and we urge China to take appropriate action in relation to such activity emanating from its territory” said Andrew Little, minister responsible for the Government Communications Security Bureau.

The broad range of cyber threats from Beijing disclosed by international bodies on Monday included a ransomware attack from alleged Chinese government-affiliated hackers that targeted victims with demands for millions of dollars. Furthermore, the exploitation of Microsoft Exchange vulnerabilities in New Zealand in early 2021, which GCSB attributed to state-sponsored Chinese actors, left many companies and organisations vulnerable to other attacks.

Cyberattacks are an increasing issue worldwide and analysts say the breadth of them and the damage they cause is get worse, putting people, businesses and governments at a disadvantage and posing a national security risk.

China has long been accused of espionage - in part, so allegedly offshore intellectual property can be stolen to benefit Chinese businesses - but the recent attacks were more widespread and also of more concern because Microsoft’s vulnerabilities were shared, allowing them to be exploited by other cyber actors.

A spokesman for the Chinese Embassy in New Zealand said the claims of China’s involvement were totally groundless and irresponsible.

“China expresses strong dissatisfaction and firm opposition and has already lodged solemn representation with the NZ government,” the spokesman said in a statement. “Given the virtual nature of cyberspace, one must have clear evidence when investigating and identifying cyber-related incidents. Making accusations without proof is malicious smear.”

READ MORE

• China fires back: Embassy says NZ Government cyber attack accusation 'groundless, irresponsible'
• Calling out China for cyberattacks is risky — but a lawless digital world is even riskier
• New Zealand joins US, UK, EU to condemn China for malicious cyber activity
• Government points finger at China over 'malicious' state-sponsored cyber-attacks in NZ

However, Little said that the GCSB has worked through a robust process to verify China’s involvement and had also confirmed Chinese state-sponsored actors were responsible for the exploitation of Microsoft Exchange vulnerabilities.

The condemnation comes at a time when a new Cold War is brewing between the US and China as concerns are raised about China’s disregard for international law in the South China Sea, the crushing of democracy movements in Hong Kong, treatment of the Uyghur population in Xinjiang and its trade activities with Australia.

It was important to see these attacks and the response in the context of these other challenges, said Waikato University international law professor Al Gillespie.

“It’s just layering up the differences between the countries. What’s happened is necessary, but the trend is negative.”

US officials alleged that China's Ministry of State Security had been using criminal contract hackers who engaged in cyber-extortion schemes and theft for their own profit. Furthermore, the Biden administration outlined concerns about the People’s Republic of China’s (PRC) “unwillingness” to address the activity.

The allies were holding China to account for its use of criminal contract hackers to conduct unsanctioned cyber operations globally, including for their own personal profit, a White House statement said.

“The PRC’s pattern of irresponsible behaviour in cyberspace is inconsistent with its stated objective of being seen as a responsible leader in the world.

“Today, countries around the world are making it clear that concerns regarding the PRC’s malicious cyber activities are bringing them together to call out those activities, promote network defence and cybersecurity, and act to disrupt threats to our economies and national security,” the statement said.

The US Justice Department on Monday also announced charges against four Chinese nationals. Prosecutors say they were working with China’s Ministry of State Security in a hacking campaign that targeted dozens of computer systems, including companies, universities and government entities.

Analysts said that they were now waiting to see whether there were further actions that reinforce the statements made.