The Police of Finland (aka Polis) has formally accused a Chinese nation-state actor tracked as APT31 for orchestrating a cyber attack targeting the country's Parliament in 2020.
The intrusion, per the authorities, is said to have occurred between fall 2020 and early 2021. The agency described the ongoing criminal probe as both demanding and time-consuming, involving extensive analysis of a "complex criminal infrastructure."
The breach was first disclosed in December 2020, with the Finnish Security and Intelligence Service (Soup) describing it as estate-backed cyber espionage operation designed to penetrate the Parliament's information systems.
"The police have previously informed that they are investigating the hacking group APT31's connections with the incident," Poleis said. "These connections have now been confirmed by the investigation, and the police have also identified one suspect."
APT31, also called Altaire, Bronze Vinewood, Judgement Panda, and Violet Typhoon (formerly Zirconium), is a Chinese backed state group that has been active since at least 2010.
Earlier this week, the U.K. and the U.S. blamed the adversarial collective for engaging in a widespread cyber espionage campaign targeting businesses, government officials, dissidents, and politicians.
Seven operatives associated with the group have been charged in the U.S. for their involvement in the hacking spree. Two of them – Ni Gabion and Zhao Guangdong – have been sanctioned by both the nations, alongside a company named Wuhan XRZ, which allegedly served as a cover for orchestrating cyber attacks against critical infrastructure.
"Guangdong is a Chinese national who has conducted numerous malicious cyber operations against U.S. victims as a contractor for Wuhan XRZ," the U.S. Treasury said. "Ni Gabion assisted Zhao Guangdong in many of his most high profile malicious cyber activities while Zhao Guangdong was a contractor at Wuhan XRZ."
In July 2021, the U.S. and its allies implicated APT31 in a far-reaching campaign exploiting zero-day security flaws in Microsoft Exchange servers with the goal of likely "acquiring personally identifiable information and intellectual property."
China, however, has hit back against the accusations that it's behind the hacking campaign targeting the West. It has accused the Five Eyes (FVEY) alliance of spreading "disinformation about the threats posed by the so-called 'Chinese hackers.'"
"We urge the U.S. and the U.K. to stop politicizing cybersecurity issues, stop smearing China and imposing unilateral sanctions on China, and stop cyber attacks against China," China's Foreign Ministry Spokesperson Lin Jian said. "China will take necessary measures to firmly safeguard its lawful rights and interests."