In recent blog posts by Microsoft, the company disclosed that a China-based hacking group referred to as "Storm-0558" have secretly accessed email accounts at around 25 organisations, including at least two US government agencies.
According to a report by The Washington Post, Commerce Secretary Gina Raimondo is the only known Cabinet-level official to have their account compromised in the targeted cyberespionage campaign. The breaches have been mitigated, as per the officials, but an FBI investigation is underway.
A senior US government official told reporters it would be unfair to compare it to the SolarWinds compromise, a sweeping set of digital break-ins that were disclosed in late 2020 and blamed on Russian cyberspies, a Reuters report said.
"This intrusion should not be compared to SolarWinds," the official said, calling the recently discovered campaign "much narrower."
The US official said he could not comment on Microsoft's decision to attribute the hack to China.
Microsoft said in a statement that the hacking group forged digital authentication tokens to access webmail accounts running on the firm's Outlook service. The activity began in May, Microsoft said.
"As with any observed nation-state actor activity, Microsoft has contacted all targeted or compromised organisations directly via their tenant admins and provided them with important information to help them investigate and respond," the company added.
Microsoft did not say which organisations or governments had been affected but added that the hacking group involved primarily targets entities in Western Europe.
China's embassy in London called the accusation "disinformation" and called the US government "the world's biggest hacking empire and global cyber thief." China routinely denies involvement in hacking operations regardless of the available evidence or context.
White House National Security Council spokesman Adam Hodge said an intrusion in Microsoft's cloud security "affected unclassified systems," without elaborating, Reuters reported.
"Officials immediately contacted Microsoft to find the source and vulnerability in their cloud service," Mr Hodge added.
The State Department "detected anomalous activity" and "took immediate steps to secure our systems," a department spokesperson said in a statement. The Commerce Department said it took "immediate action" after Microsoft notified it of a compromise.
Private sector cybersecurity experts have said newly discovered hacking activity shows how Chinese groups are improving their cyber capabilities.
"Chinese cyber espionage has come a long way from the smash-and-grab tactics many of us are familiar with," said John Hultquist, chief analyst for U.S. cybersecurity firm Mandiant.
