PHNOM PENH, CAMBODIA - Cyberattackers have been caught hacking key Cambodian government institutions in what is strongly believed to be a coordinated Chinese government attack ahead of elections set for this month, a U.S. cybersecurity firm has alleged.
Cambodia's National Election Committee, Senate, Ministry of Foreign Affairs, Ministry of Interior, and Ministry of Economy and Finance have all been breached, along with computer systems of foreign diplomats, media institutions and opposition figures, an investigation by FireEye Inc. concluded.
"We expect this activity to provide the Chinese government with widespread visibility into Cambodian elections and government operations," the firm said in a report issued Tuesday. "Additionally, this group is clearly able to run several large-scale intrusions concurrently across a wide range of victim types."
Cambodians head to the polls on July 29 in elections that follow last year's dissolution of the opposition Cambodia National Rescue Party (CNRP), the only viable contender to the ruling Cambodian People's Party (CPP).
FireEye discovered that a suite of malicious software, or malware, that they had tracked since 2013 had been deployed against Cambodian political targets since at least April 2017, including numerous members of the CNRP.
The malware suite — TEMP.Periscope — was carelessly left on publicly accessible servers, allowing FireEye to observe its logs, which revealed "objectives, operational tactics, and a significant amount of technical attribution-validation."
The information included evidence that attackers operated from locations in China using local-language computer systems, as well as behavior consistent with known Chinese cyberespionage practices, FireEye said.
It further strengthened FireEye's long-held belief that the software, which it said has previously been used against maritime targets related to China's sensitive claims over the South China Sea, is being deployed by Beijing.
?
Benjamin Read, senior manager of cyberespionage analysis at FireEye, said China could just be conducting traditional espionage to keep tabs on a strategically important partner but might also be orchestrating something "a little bit more concerning."
"Obviously in the United States, in France, you saw these sorts of information operation campaigns that followed after hacking," Read said.
Russia has been accused of trying to rig elections in both those countries by hacking the private data of candidates, leaking it, and then using it as the basis of large, targeted social media campaigns against them.
Read said FireEye had not attributed coordinated campaigns of that nature to China before.
"But the broad targeting of Cambodian institutions, both government and opposition leading up to the elections, raised that possibility," he added.
FireEye's report said the same software tools were used against commercial targets, including what it described as a defense industrial base in the United States and a chemical company in Europe.
The Chinese Embassy in Phnom Penh declined to comment and the Cyberspace Administration of China did not reply to VOA inquiries.
Cambodia has fallen under the orbit of Beijing in recent years, becoming a key supporter within the Association of Southeast Asian Nations of China's claims to the South China Sea. China, in turn, has showered Prime Minister Hun Sen, who has ruled for 33 years, with investments, infrastructure loans and political support.
Calls to officials in the Cambodian government bodies identified in the report have gone unanswered, while Ou Phannarith, director of the Department of ICT Security, could not be reached.
FireEye has not been able to provide any detail on what information was stolen from those targeted in the attacks — whom they were able to identify from logs on the malware servers.
In-Q-Tel, a nonprofit CIA-funded venture capital fund, has a less than 1 percent stake in FireEye, according to a 2014 post on its website.
The malicious servers in question were discovered after FireEye began investigating a suspicious email that was sent to Kem Monovithya, the daughter of jailed CNRP leader Kem Sokha.
Kem Monovithya, who was also the CNRP deputy public affairs head, received what appeared to be a perfectly normal email from the respected Cambodian human rights group Licadho.
"I've been receiving a lot of phishing emails for the last year or so, but a lot of them are very obvious, but this one wasn't. It was very personal," she said.