Czech Republic Accuses China of Government Hack

The Czech Republic has accused the Chinese government of being behind a malicious cyber campaign which targeted the Czech Ministry of Foreign Affairs.

In a public statement issued on May 28, Czech authorities said Beijing had sponsored cyberespionage actor APT31 to conduct the campaign and target one of the unclassified networks of the Ministry of Foreign Affairs.

The campaign began in 2022 and affected an institution designated as Czech critical infrastructure, according four Czech government agencies which had investigated the incident.

The four agencies included the Security Information Service (BIS), Military Intelligence (VZ), the Office for Foreign Relations and Information (ÚZSI) and the National Cyber and Information Security Agency (NÚKIB),

The extent of the breach, if any, remains unverified.

Violation of the UN’s Responsible State Behavior

This is the first time the Czech Republic has officially attributed a cyber-attack to a nation-state actor.

According to the Czech government, such behavior “undermines the credibility of the People’s Republic of China (PRC) and contradicts its public declarations.”

“These activities are contrary to the norms of responsible state behavior in cyberspace, as endorsed by all UN Members.”

It called on China to adhere to these norms and principles, saying that the PRC should “refrain from such attacks and take all appropriate measures to address this situation.”

Jan Lipavský, the Czech Foreign Minister, commented: “With today’s move, we have exposed China, which has long been working to undermine our resilience and democracy. Through cyber-attacks, information manipulation and propaganda, it interferes in our society – and we must defend ourselves against that.” 

Lipavský also summoned Chinese ambassador Feng Biao.

“The EU and its Member States and NATO Allies express solidarity with Czechia following this cyber-attack,” said the Czech government statement.

In a supporting statement, the North Atlantic Council, NATO’s political executive body, said that this campaign is evidence of “the growing pattern of malicious cyber activities stemming from the People’s Republic of China.”

“We strongly condemn malicious cyber activities intended to undermine our national security, democratic institutions and critical infrastructure. The malicious cyber activity targeting the Czech Republic underscores that cyberspace is contested at all times,”the North Atlantic Council added.

Who is Behind APT31

APT31 is a cyber espionage group that steals intellectual property, particularly targeting data and projects that give organizations a competitive edge.

The group, also known as Violet Typhoo, Bronze Vinewood, Judgment Panda, Zirconium and RedBravo, has been active since at least 2012. Several Western governments believe APT31 to be linked to China’s Ministry of State Security (MSS).

APT31’s targets include government agencies, military organizations and private companies.

Notably, APT31 has been accused of being behind the 2021 hack of UK parliamentarians’ emails.

In March 2024, the US Department of Justice unsealed an indictment charging seven Chinese individuals associated with APT31 with conspiracy to commit computer intrusions and wire fraud, shedding light on the group’s extensive cyber operations targeting perceived critics of China over approximately 14 years.