On Tuesday, Australia’s government cybersecurity agency accused a China-backed hacker group of stealing passwords and usernames from two unidentified Australian networks in 2022, warning that the group remains a threat.
A joint report led by the Australian Cyber Security Centre identified the hackers as APT40, stating they conducted malicious cyber operations for China’s Ministry of State Security, the main agency responsible for foreign intelligence. “The activity and techniques overlap with the groups tracked as Advanced Persistent Threat (APT) 40,” the report noted, which included inputs from leading cybersecurity agencies in the United States, Britain, Canada, New Zealand, Japan, South Korea, and Germany. China’s embassy in Australia did not immediately respond to a request for comment.
In March, U.S. and British officials accused Beijing of a widespread cyberespionage campaign affecting millions, including lawmakers, academics, journalists, and defense contractors. They attributed these intrusions to China-backed “APT31.” China dismissed the allegations as “political maneuvering.”
APTs refer to cyber actors or groups, often state-backed, engaged in malicious cyber activities. In March, New Zealand reported that APT40 targeted its parliamentary services and counsel office in 2021, accessing significant information.
“The Australian government is committed to defending Australian organizations and individuals in the cyber domain, which is why for the first time we are leading this type of cyber attribution,” said Defence Minister Richard Marles in a statement. Details of the companies’ artificial intelligence products were reportedly stolen.
This report comes as Australia and China work to rebuild ties after a period of strained relations. Relations soured in 2020 when Canberra called for an independent investigation into the origin of COVID-19, prompting Beijing to impose tariffs on several Australian commodities, most of which have since been lifted.