The Czech Republic has formally accused China of orchestrating a cyber attack against its Ministry of Foreign Affairs. According to an official government statement, a state-sponsored threat actor known as APT31 targeted an unclassified network of the ministry in a campaign that began in 2022 and affected systems designated as critical infrastructure.

APT31, also known by aliases including Altaire, Bronze Vinewood, and Violet Typhoon, has been linked to China’s Ministry of State Security and the Hubei State Security Department. The group has reportedly been active since at least 2010, according to the U.S. Department of Justice.

Security experts note that APT31 employs sophisticated techniques to evade detection, including using public code repositories and file-sharing websites for command and control operations. The group primarily targets government organizations, defense supply chains, and their service providers.

This accusation follows recent APT31 activities elsewhere:

– In March 2024, the U.S. Department of Justice indicted seven hackers associated with the group for cyber espionage against critics, journalists, and political officials
– Finland’s police identified APT31 as responsible for a 2020 attack on the country’s Parliament
– ESET recently reported that APT31 targeted a Central European government entity in December 2024 with an espionage backdoor called NanoSlate

The Czech government strongly condemned the attack, stating that “such behavior undermines the credibility of the People’s Republic of China and contradicts its public declarations.” Officials added that these activities violate responsible state behavior in cyberspace as endorsed by the United Nations, and called on China to adhere to international norms.