Chinese APT suspected of Ministry of Defence hack

Link to China unclear

Although no formal attribution has been made to any Chinese APT, the Chinese government has already moved to angrily reject any accusations that its intelligence agencies were behind the latest incident, which comes in the wake of other large-scale breaches of UK government entities and officials – such as that of the Electoral Commission – linked to China, over which multiple individuals have been sanctioned, both in the UK and the US.

Speaking to Computer Weekly earlier today, former NCSC chief Ciaran Martin said that while the attack on the MoD bore the hallmarks of nation-state espionage, the possibility of a nation-state’s involvement in cyber espionage was not unexpected and the UK government’s reaction sometimes risked making it hard to see the wood for the trees.

“I’m sitting in a country that for the second time in a month is getting very exercised about Chinese espionage against government, once in Parliament, the other now in defence, which is serious, it’s unwelcome, it’s damaging. But at the same time, there’s no serious proposal anywhere that spying on governments, especially defence or foreign ministries, is beyond the pale. It is a widespread activity,” he said.

Martin explained that in terms of general public discourse, the prevailing narrative has become one of ongoing Chinese cyber espionage against Parliament and the government, but he pointed out that espionage long pre-dates the digital world and is to be expected, while there are other facets to malign Chinese cyber activity more worthy of urgent attention.

“We’re absolutely missing the fact that the US has warned that there is the equivalent of digital explosives under quite a lot of critical infrastructure that can’t kill people, but could cripple the administration of aviation, the administration of healthcare, the administration of all sorts of critical services,” said Martin. “That, to me, is a much, much more important thing to focus national effort on.”

Whatever its provenance, the incident is clearly a serious supply chain breach, with lessons for all organisations.

“Cyber attacks on third-party suppliers continue to highlight the threat that vulnerabilities in the supply chain pose to UK organisations,” said Philip Tansley, a security lawyer at Osborne Clarke.

“Every large organisation – including government departments – will outsource some operations to third-party suppliers. This is not itself a bad thing but, as the process of outsourcing becomes increasingly complex and digitised and those suppliers outsource functions themselves, it is becoming increasingly difficult to monitor and manage the risks that a weak link in the supply chain poses.

“Proper oversight and understanding of where vulnerabilities exist by organisations is vital to enable them to manage and allocate risk appropriately and comply with contractual and regulatory obligations,” he said.

This article was updated at 4pm on Wednesday 8 May to reflect the involvement of SSCL.