Covid intelligence: Who was responsible for the cyber-attacks on China?

Donald Trump is not alone in having suspicions about China’s involvement with coronavirus: Vietnam and Israel have questions too, writes Kim Sengupta

Until recently Trump was fulsome in his praise of Chinese president Xi Jinping (Reuters)

The cyber-attacks were aimed at China’s Ministry of Emergency Management (MoEM) and the provincial government of Wuhan. The aim was to collect information about coronavirus, a disease about which little was known at the time – its origins and its impact shrouded in mystery. This was not, however, the work of the US, British or other western intelligence agencies whose operations are now under focus, with Donald Trump, his administration and Republicans in Congress embarked on a policy of charging Beijing for the spread of the lethal pandemic and threatening severe consequences.

The spear phishing campaign was run by an espionage group called Ocean Lotus, also known as APT (Advanced Persistent Threat) 32 which, it is widely held in security circles, is linked to Vietnamese state intelligence. It has, in that capacity, targeted a number of foreign governments, private companies and individuals, according to research carried out by the US cybersecurity firm FireEye and other analysts.

APT32 seems to have become particularly active in China in the recent past. It began to be particularly busy from 6 January when it sent an email to Beijing’s MoEM using the sender address lijanxiang1870@163. This was two weeks before the Chinese government admitted that the disease could be transmitted between humans. “These attacks speak of the virus being an intelligence priority. Everyone is throwing everything they’ve got at it, and APT32 is what Vietnam has,” said Ben Read, senior manager at FireEye’s intelligence unit.