China has accused US intelligence agencies of exploiting a Microsoft Exchange zero-day exploit to steal defense-related data and take over more than 50 devices belonging to a "major Chinese military enterprise" for nearly a year.
In a Thursday alert, the National Computer Network Emergency Response Technical Team / Coordination Center of China (CNCERT/CC), a group which claims that it is non-governmental, said American cyberattacks against Chinese high-tech, defense-related universities, research institutes, and enterprises "have become more targeted and their methods, more covert."
These data-stealing campaigns pose "a serious threat to the scientific research and production security of China's defense and defense industries, and even to national security," the alert continues.
The US National Security Agency did not immediately respond to The Register's inquiries.
CNCERT/CC's claims about American spies infiltrating military and defense-related organizations follow several recent allegations from the US about Chinese snooping activity.
Last week, US-based security firms including Microsoft blamed recent SharePoint zero-day attacks on several Chinese groups, including at least two Beijing-backed snooping and data stealing crews, and a China-based ransomware gang.
And earlier this week, SentinelLabs' security researchers uncovered more than a dozen patents for offensive cybersecurity tools filed by Chinese companies allegedly tied to Beijing's Silk Typhoon espionage crew.
Uncle Sam purloined emails, alert claims
The Thursday CNCERT/CCalert doesn't name any specific organizations American intelligence allegedly compromised, nor specific vulnerabilities that were abused.
It says one involved exploiting a Microsoft Exchange zero-day to break into an email server belonging to a "major Chinese military enterprise" from July 2022 to July 2023.
"Investigations revealed that the attackers gained control of the enterprise's domain controller server, using it as a springboard to gain control of over 50 critical devices within the intranet," according to the alert.
Microsoft declined The Register's request for comment.
CNCERT/CC said the intruders used WebSocket communication within an SSH tunnel to remotely access one of the company's external servers, and "established multiple covert channels" to steal data.
During this same time period, the organization claims, Americans used IP addresses from multiple countries including Germany, Finland, South Korea, and Singapore to launch more than 40 cyberattacks, stealing emails from 11 people including senior execs at the defense company.
These emails allegedly contained design plans and detailed system information related to Chinese military products.
In a second attack detailed in the Thursday security bulletin, CNCERT/CC said that the US exploited bugs in electronic file systems between July and November 2024 to compromise "a Chinese military-industrial enterprise in the communications and satellite internet sectors."
American spies allegedly used IP addresses from Romania and the Netherlands to exploit SQL injection vulnerabilities, backdoor the organization's file server and upload malware and compromise more than 300 devices.
"They then searched for keywords such as 'military network' and 'core network' to steal sensitive data from the compromised hosts," CNCERT/CC said. ®