A cybersecurity firm in the United States believes state-sponsored Chinese hackers were trying to infiltrate an organization with connections to a US-built missile system in South Korea that Beijing firmly opposes.
“China uses cyber espionage pretty regularly when Chinese interests are at stake to better understand facts on the ground,” John Hultquist, the director of cyber espionage analysis at FireEye, told CNN’s News Stream.
“We have evidence that they targeted at least one party that has been associated with the missile placements.”
A spokesperson with South Korea’s Ministry of Foreign Affairs told CNN there was an attempted cyber attack last month on their systems originating from China, but would not comment when asked if THAAD was targeted.
The official said “prompt defensive measures” blocked the hackers.
China’s Ministry of Foreign Affairs told CNN the Chinese government opposes any form of cyber attack, and fights against all form of hacker activity.
“This position is consistent, clear, and serious,” it said in a statement.
The statement reiterated China’s opposition to THAAD and called on the US and South Korea to halt its deployment. On Wednesday, the top US commander in the Pacific said the defense system would be operational in days.
When asked if the group could be North Koreans posing as Chinese hackers, Hultquist said his team has gathered plenty of evidence to prove the group’s origins, including their use of the Chinese language.
“We’ve known these actors for several years now and we’ve watched their activities.”
Intelligence not disruption
The spying on the Terminal High Altitude Area Defense (THAAD) system was likely done for intelligence purposes, not to disrupt it, Hultquist said.
“If it were done in retaliation we’d expect some sort of follow on disruption or destruction of it, which we didn’t see. Typically, when we see cyber espionage actors, they prefer to stay quiet and remain on target where they can gather as much intelligence as possible,” Hultquist said.
THAAD is a missile defense system the US is deploying in South Korea in case of an attack by North Korea. It detects incoming projectiles and shoots them down. Some military experts compare it to hitting a bullet with another bullet.
The system is controversial in South Korea. Some worry its deployment fuels a cycle of militarization on the Korean Peninsula.
Around 400 protesters gathered as parts of the system was moved Wednesday to Seongju county, where it is set to be deployed. Locals complain about the lack of consultation regarding the deployment.
Why target THAAD?
Analysts say Beijing believes THAAD’s extremely powerful radar could be used to monitor activities inside China despite its stated use as a countermeasure against North Korea.
“The US-South Korean deployment of THAAD in South Korea will harm strategic balance in the region and further stimulate tensions on the Korean Peninsula. It won’t help achieve the goal of denuclearization or maintaining peace and stability in the region,” Chinese Foreign Ministry Spokesman Geng Shuang said Wednesday.
South Koreans have accused China of enacting ‘unofficial’ sanctions in response to the THAAD deployment. Lotte, the company that owns the land where THAAD has been deployed, has seen 87 of its 99 stores in China closed and work on its theme park in the country suspended.
Those developments fueled concerns the disagreement could spiral into a trade war.
China’s Ministry of Foreign Affairs has repeatedly denied any knowledge of restrictions being placed on South Korean businesses over THAAD.