Spear-phishing attack against UK parliamentarians (2021-2022)

Date 	2021-2022. Foreign, Commonwealth & Development Office, ‘Press release: UK holds China state-affiliated organisations and individuals responsible for malicious cyber activity’ (25 March 2024).
Suspected actor	Advanced Persistent Threat 31 (‘APT31’) – a hacker group allegedly affiliated with China. This is an official attribution made by the UK and US U.S. Department of Justice, 'Seven Hackers Associated with Chinese Government Charged with Computer Intrusions Targeting Perceived Critics of China and U.S. Businesses and Politicians' (25 March 2024).), whilst China has denied connection with APT31.Embassy of the People’s Republic of China in the Commonwealth of Australia, ‘Foreign Ministry’s Spokesperson’s Remarks’ (27 March 2024).
Target 	The emails of UK parliamentarians, many of whom have been vocal about China’s ‘malign activity’, were subject to 'reconnaisance activity'.UK National Cyber Security Centre, ‘UK calls out China state-affiliated actors for malicious cyber targeting of UK democratic institutions and parliamentarians’ (25 March 2024).
Target systems 	N/A
Method 	Spear-phishing; victims were sent malicious emails containing links designed to extract private details (i.e. passwords) in order to access private and sensitive information.UK Office of Financial Sanctions Implementation, Financial Sanctions Notice (WUHAN XIAORUIZHI SCIENCE AND TECHNOLOGY COMPANY LIMITED) (25 March 2024), page 6. The US Department of Justice have alleged that APT31 used ‘hidden tracking links’ in these attacks, which extract the victim’s IP address, location, type of device and network schematics simply by opening the email itself. U.S. Department of Justice, 'Seven Hackers Associated with Chinese Government Charged with Computer Intrusions Targeting Perceived Critics of China and U.S. Businesses and Politicians' (25 March 2024).
Purpose 	The UK’s National Cyber Security Centre has assessed that the extracted data would be used for political espionage and repression of Chinese dissidents and critics in the UK. Lord Cameron, the then UK Foreign Secretary, characterised the attacks as an attempt to ‘interfere with UK democracy’. The attacks can be viewed as part of a broader international campaign to silence critics of the Chinese government. For example, APT31 previously conducted cyber operations against groups and individuals perceived to be critical of the Chinese government, such as activists campaigning for democracy in Hong Kong and their associates there, in Norway and the United States.
Result 	The UK stated that the threat had been successfully identified and neutralised by Parliament’s Security Department before any accounts could be compromised.
Aftermath 	The UK summoned the Chinese Ambassador to the UK, and the Foreign Secretary spoke with Chinese Foreign Minister Wang Yi. Sanctions were levied against Zhao Guangzong and Ni Gaobin, alleged members of APT31, as well as against Wuhan Xiaoruizhi Science and Technology Company Limited, which the UK claims is a front company for APT31.Similarly, the US Department of Justice unveiled sanctions against Guangzong and Gaobin, as well as five other PRC nationals associated with APT31.
Analysed in 	Scenario 02: Cyber espionage against government departments
Collected by: Tom Davies
Category:Example
Category:2021