China accused of launching 'cyber war' over contested islands

China, in pursuit of its territorial claims in the resource-rich South China Sea, is resorting to low-level cyber warfare against the Philippines and Vietnam — the two nations who recently won an international legal case against the Communist government.

China, in pursuit of its territorial claims in the resource-rich South China Sea, is resorting to low-level cyber warfare against the Philippines and Vietnam — the two nations who recently won an international legal case against the Communist government.

Reports in local media and by regional cybersecurity companies have attributed a rash of cyber vandalism attacks in the past two weeks to a Chinese hacktivist group calling itself 1937cn — an apparent reference to the Japanese invasion of China that year.

In the highest profile attack at the end of July, hackers took over the website of  Vietnam’s national airline and the display screens in the country’s two largest airports and displayed pro-Chinese, anti-Vietnam and anti-Philippine messages.

Websites in the Philippines were also attacked, with local security companies saying the hacks were part of a long-running campaign aimed at the computer networks of government agencies and critical infrastructure owners and operators.

Vietnamese sources have blamed China and linked the attacks to last month’s ruling by the Permanent Court of Arbitration in The Hague, which denied Beijing’s extensive territorial claims in the South China Seas. About $5 trillion worth of shipping trade passes each year through the seas’ waters  — which abut China, Malaysia, the Philippines, Taiwan and Vietnam, and are believed to house huge fish stocks as well as vast deposits of undersea oil and gas.

The self-described leader of 1937cn told Chinese state media the group is a patriotic non-government organization, but didn’t entirely deny responsibility.

Security experts and former officials in the region say the plausible deniability of using patriotic hacktivists as a cut-out for government-inspired or -directed online attacks is straight out of China’s cyber playbook.

“China’s strategic cyber doctrine is the basis of the current [cyber] operations against Vietnam and the Philippines,”  wrote S. D. Pradhan, the former chairman of Delhi’s Joint Intelligence Committee, in a Times of India op-ed.

In Russian doctrine, security analysts have identified cyberwarfare a part of a “hybrid warfare” strategy, in which information operations and deniable military forces (the “little green men” of Ukraine fame) are fused to leverage Russian strategic might and advance national goals.

But in China’s military thinking, Pradhan states, cyber-operations are aimed at deterrence and are also seen as potentially part of “no contact warfare” —  “winning war without casualties,” and projecting power over great distances “to achieve a quick decisive victory by disrupting, denying and destroying the enemy’s war waging potential and its command and control systems through remote delivery of destructive kinetic energy and effective cyber operations.”

In China’s concept of “‘integrated strategic deterrence,’ cyber operations have the central role,” he noted, adding, “Deterrence is achieved by projecting its capabilities for infiltration of critical infrastructure of adversaries,” such as the computer networks at a major airport.

By successfully attacking the national airline’s website and airport announcement systems, Pradhan added, “China has conveyed her capabilities to infiltrate into [an] adversary’s … most critical and secured infrastructure.”

Underlining the seriousness of the threat represented by the airports hack, Vietnamese banks also briefly suspended online banking and payment services in its wake, as a precautionary measure until the extent of the attack was clear, one bank executive told TalkVietnam.

“This is an appropriate move as we haven’t fully assessed the effects of the cyber attacks,” said the executive.

Later, local security firm Bvak told the official Vietnam News Agency that the malware used in the attack was a keylogger and remote access trojan, which disguised itself as an anti-virus program.

An executive from the firm, Ngo Tuan Anh, said the malware had been active on the networks of government agencies, business groups, banks, and universities since 2012, underlining the importance of battle-space preparation in the cyber world.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure