There is significant debate among experts regarding the definition of cyberwarfare, and even if such a thing exists.[2] One view is that the term is a misnomer since no cyber attacks to date could be described as a war.[3] An alternative view is that it is a suitable label for cyber attacks which cause physical damage to people and objects in the real world.[4]
Many countries, including the United States, United Kingdom, Russia, China, Israel, Iran, and North Korea,[5][6][7][8] have active cyber capabilities for offensive and defensive operations. As states explore the use of cyber operations and combine capabilities, the likelihood of physical confrontation and violence playing out as a result of, or part of, a cyber operation is increased. However, meeting the scale and protracted nature of war is unlikely, thus ambiguity remains.[9]
“Non-governmental forces” (民间力量) - civilian and semi-civilian[definition needed] groups that spontaneously engage in network attack and defense.[10]
In response to claims that Chinese universities, businesses, and politicians have been subject to cyber espionage by the United StatesNational Security Agency since 2009,[11][12] the PLA announced a cyber security squad in May 2011 to defend their own networks.[13]
Officials in the Canadian government claimed that Chinese hackers compromised several departments within the federal government in early 2011, though the Chinese government has denied involvement.[50] In 2014, Canada's Chief Information Officer claimed that Chinese hackers compromised computer systems within the National Research Council.[51] In May 2023, Canada's Communications Security Establishment identified the Chinese government as being behind the "Volt Typhoon" advanced persistent threat targeting critical infrastructure.[52] In July 2024, government agencies from eight nations, including the Canadian Centre for Cyber Security, released a joint advisory on APT40.[48][49]
Officials in the Indian government believe that attacks on Indian government networks, such as the attack on the Indian National Security Council, have originated from China. According to the Indian government, Chinese hackers are experts in operating botnets, of which were used in these attacks.[53] Additionally, other instances of Chinese cyberattacks against India's cyberspace have been reported in multitude.[54][55]
In April 2021, Japan claimed that the Chinese military ordered cyberattacks on about 200 Japanese companies and research institutes, including JAXA.[56] In July 2024, government agencies from eight nations, including Japan's National Police Agency, released a joint advisory on APT40.[48][49]
In May 2023, New Zealand, alongside other Five Eyes member states, named the Chinese government as being behind the "Volt Typhoon" advanced persistent threat targeting critical infrastructure.[58] In March 2024, the Government Communications Security Bureau and New Zealand Government accused the Chinese government via APT40 of breaching its parliamentary network in 2021.[59] In July 2024, government agencies from eight nations, including the New Zealand National Cyber Security Centre, released a joint advisory on APT40.[48][49]
In July 2024, government agencies from eight nations, including South Korea's National Intelligence Service, released a joint advisory on APT40.[48][49]
The United States has accused China of cyberwarfare attacks that targeted the networks of important American military, commercial, research, and industrial organizations. A Congressional advisory group has declared China "the single greatest risk to the security of American technologies"[60] and "there has been a marked increase in cyber intrusions originating in China and targeting U.S. government and defense-related computer systems".[60][61][62][63] China's cyberwarfare has expanded from cyber-espionage to "pre-positioning" activity for the sabotage and crippling of critical infrastructure.[64]
In January 2010, Google reported targeted attacks on its corporate infrastructure originating from China "that resulted in the theft of intellectual property from Google." Gmail accounts belonging to two human rights activists were compromised in an attack on Google's password system.[65] Chinese hackers also gained access to a database containing classified information about suspected spies, agents, and terrorists under surveillance by the US government.[66] American security experts connected the Google attack to various other political and corporate espionage efforts originating from China, which included spying against military, commercial, research, and industrial corporations.[63]Obama administration officials called the cyberattacks "an increasingly serious cyber threat to US critical industries."[61]
Diplomatic cables highlight US concerns that China is exploiting its access to Microsoft source code to boost its offensive and defensive capabilities.[69]
A number of private computer security firms have stated that they have growing evidence of cyber-espionage efforts originating from China, including the "Comment Group".[70]
In 2011, a Chinese state TV program displayed outdated screenshots of a Chinese military institute performing cyber attacks on a US-based dissident entity.[77] The direct visual evidence from an official Chinese source challenges China's claims that it never engages in overseas hacking for government purposes.[77]
During March 2013, high-level discussions continued.[78]
In May 2014, a federal grand jury in the United States indicted five PLA Unit 61398 officers on charges of theft of confidential business information from U.S. commercial firms and planting malware on their computers.[79][80]
In September 2014, a Senate Armed Services Committee probe revealed hackers associated with the Chinese government committing various intrusions of computer systems belonging to U.S. airlines, technology companies and other contractors involved with the movement of U.S. troops and military equipment,[81] and in October 2014, The FBI added that hackers, who they believe to be backed by the Chinese government, have recently launched attacks on U.S. companies.[82]
In 2015, the U.S. Office of Personnel Management (OPM) announced that it had been the target of a data breach targeting the records of as many as 21.5 million people.[83]The Washington Post reported that the attack came from China, citing unnamed government officials.[84]FBI directorJames Comey explained "it is a very big deal from a national security perspective and a counterintelligence perspective. It's a treasure trove of information about everybody who has worked for, tried to work for, or works for the United States government."[85]
In October 2018, Bloomberg Businessweek published a report, citing unnamed corporate and governmental sources, which claimed that the PLA had forced Supermicro's Chinese sub-contractors to add microchips with hardware backdoors to its servers. The report claimed that the compromised servers had been sold to U.S. government divisions (including the CIA and Department of Defense) and contractors and at least 30 commercial clients.[86]
In 2019, a study showed continued attacks on the US Navy and its industrial partners.[87]
In February 2020, a US federal grand jury charged four members of China's People's Liberation Army (PLA) with the 2017 Equifax hack.[88] The official account of FBI stated on Twitter that they played a role in "one of the largest thefts of personally identifiable information by state-sponsored hackers ever recorded".[89]
The Voice of America reported in April 2020 that "U.S. intelligence agencies concluded the Chinese hackers meddled in both the 2016 and 2018 elections" and said "there have already been signs that China-allied hackers have engaged in so-called "spear-phishing" attacks on American political targets" ahead of the 2020 United States elections.[90]
In March 2021, United States intelligence community released analysis in finding that China had considered interfering with the election but decided against it on concerns it would fail or backfire.[91]
In April 2021, FireEye said that suspected Chinese hackers used a zero-day attack against Pulse Connect Secure devices, a VPN device, in order to spy on dozens of government, defense industry and financial targets in the U.S. and Europe.[92][93][94][95]
In May 2023, Microsoft and Western intelligence agencies reported that a Chinese state-sponsored hacking group affiliated with the PLA called "Volt Typhoon" had targeted critical infrastructure and military installations in Guam, Hawaii, Texas and elsewhere.[96][97][98] In January 2024, US authorities stated that they disrupted an operation by Volt Typhoon that had access to critical infrastructure in the US for at least five years.[99][100]
In February 2024, OpenAI announced that it had shut down accounts used by the Charcoal Typhoon and Salmon Typhoon hacking groups. The groups had been using their services to research companies, intelligence agencies, cybersecurity tools and evasion techniques, translate technical papers, write and refactor code, and create phishing campaign content.[101][102] The same month, leaked documents from an MSS, PLA, and MPS contractor based in Shanghai called I-Soon, also known as Auxun, provided details into a campaign to harass dissidents, activists, critical academics, and Uyghurs overseas.[103][104][105]
In July 2024, government agencies from eight nations, including the National Security Agency and Cybersecurity and Infrastructure Security Agency, released a joint advisory on APT40.[48][49] In September 2024, FBI director Christopher A. Wray announced that Chinese state hacking campaign known as Flax Typhoon, which targeted critical infrastructure, had been disrupted.[106][107] In November 2024, Texas governor Greg Abbott ordered state agencies to harden critical infrastructure from cyberattacks from threats emanating from the PRC.[108]
Comparing the semiconductor industry in China mainland and Taiwan today, Taiwan is the leader in terms of overall competitiveness. On 6 August 2020, Wired published a report, stating that "Taiwan has faced existential conflict with China for its entire existence and has been targeted by China's state-sponsored hackers for years. But an investigation by one Taiwanese security firm has revealed just how deeply a single group of Chinese hackers was able to penetrate an industry at the core of the Taiwanese economy, pillaging practically its entire semiconductor industry."[109]
In May 2023, the UK's National Cyber Security Centre, alongside other Five Eyes member states, identified the Chinese government behind the "Volt Typhoon" advanced persistent threat targeting critical infrastructure.[47][112]
In July 2020, it was reported that Chinese state-sponsored hackers operating under the named RedDelta hacked the Vatican's computer network ahead of negotiations between China and the Vatican.[115]
During 18 minutes on April 8, 2010, state-owned China Telecom advertised erroneous network routes that instructed "massive volumes" of U.S. and other foreign Internet traffic to go through Chinese servers. A US Defense Department spokesman told reporters that he did not know if "we've determined whether that particular incident ... was done with some malicious intent or not" and China Telecom denied the charge that it "hijacked" U.S. Internet traffic.[116]
^Lucas, George (2017). Ethics and Cyber Warfare: The Quest for Responsible Security in the Age of Digital Warfare. Oxford. p. 6. ISBN9780190276522.{{cite book}}: CS1 maint: location missing publisher (link)
^Stone, Jeff (October 5, 2020). "Foreign spies use front companies to disguise their hacking, borrowing an old camouflage tactic". cyberscoop.com. Cyberscoop. Archived from the original on March 22, 2021. Retrieved October 11, 2020. In China not all of these companies are 'front companies' in the strict sense that they were established by intelligence agencies to hide their involvement. The APT landscape in China is run in a 'whole country' approach, leveraging skills from universities, individual, and private and public sectors. So some of the smaller companies might just be a way for individual hackers to band together and be eligible for government contracts.
^van Dantzig, Maarten; Schamper, Erik (December 19, 2019). "Wocao APT20"(PDF). fox-it.com. NCC Group. Archived from the original(PDF) on March 22, 2021. Retrieved December 23, 2019.
^Burt, Tom (March 2, 2021). "New nation-state cyberattacks". blogs.microsoft.com. Microsoft. Archived from the original on March 2, 2021. Retrieved March 3, 2021.