Last week it was announced that MPs Els Van Hoof (CD&V) and Samuel Cogolati (Ecolo-Groen) were attacked by the hacker group APT31 in 2021. That group has ties to the Chinese Ministry of State Security. This is evident from research by the American security service FBI, which discovered the facts in 2022 and reported them to the Belgian authorities.
The same FBI investigation shows that liberal MEPs Hilde Vautmans and (also ex-prime minister) Guy Verhofstadt (Open VLD), and MP Georges Dallemagne (Les Engagés) were also targeted in a large-scale campaign of cyber espionage with phishing emails. This is what IPAC, the international association of parliamentarians working on human rights in China, said. IPAC received confirmation from the FBI of the targeted email addresses.
Trackingpixel
The tactics were often the same: an innocent-looking email, for example about Chinese human rights violations, contained a so-called tracking pixel: a tiny image. When the recipient (automatically) displays images of emails in his email program, the sender is forwarded, among other things, IP address, operating system, browser, and possibly also the location.
The work of professionals, although that did not mean that the mailbox was suddenly compromised. “The forwarded data will make it easier to hack in the next wave,” says British Luke de Pulford, founder and director of IPAC. “That happened to a member of parliament from France and the Czech Republic. Precisely because it can escalate, rapid awareness of parliamentarians is important.”
Foreign Minister Hadja Lahbib (MR) said on Thursday that she would summon the chargé d’affaires from the Chinese embassy, but Cogolati states that this should have happened in 2022, so that the targeted parliamentarians could immediately arm themselves against the hackers. Several people at IPAC believe that our country did not dare to warn them at the time, for fear of a diplomatic row.
However, the five believe that more decisive action is needed. “Over the past decade, China has become increasingly willing to interfere with the political systems of other countries. Too often, these malicious acts have gone unanswered,” the joint statement said. “We want there to be a proportionate response.” To start, they ask the Belgian government to formally attribute the attack to APT31. “As the US and the UK have already done, and Belgium itself also did when Defense and the FPS Home Affairs were attacked by the same hackers in July 2022.”
Freeze funds
Last month, names of APT31 hackers were revealed in a US lawsuit. The five also request that any financial assets be frozen and that an official travel ban be imposed on them. They also ask for better security for parliamentarians and to inform them more quickly if such attacks occur again.
Finally, they also hope that a judicial investigation will follow for foreign interference.
Lahbib’s spokesperson says that several measures have already been taken. “We analyze with the services involved what consequences we give to these attacks.” The De Croo cabinet could not immediately respond to the letter on Sunday. It is emphasized that State Security has previously informed the affected parliamentarians.
