...
By Micah McCartney
Reporter
0
Share
Newsweek is a Trust Project member
See more of our trusted coverage when you search.Prefer Newsweek on Googleto see more of our trusted coverage when you search.
Google and its cybersecurity partners have disrupted a cyber espionage group with suspected ties to the Chinese state, the company said Wednesday.
It was one of several such operations involving enforcement actions against Chinese cyberoperations this week, including misuse of AI to train domestic large language models (LLM) and carry out pro-Beijing influence operations.
Why It Matters
The disclosure follows a string of Chinese-linked hacking campaigns in recent years, some believed to have state backing, that have targeted government officials, think tanks and Chinese dissidents overseas.
Read More on Tech
Other groups have sought access to U.S. critical infrastructure. American intelligence officials have warned that such access, if established, could be weaponized in the event of a conflict with Beijing.
Newsweek reached out to the Chinese Embassy in Washington, D.C., by email with a request for comment.
Who Was The Hacking Group Shut Down by Google?
“Last week, Google Threat Intelligence Group (GTIG), Mandiant, and partners took action to disrupt a global espionage campaign targeting telecommunications and government organizations in dozens of countries across four continents,” GTIG said in a statement.
The threat actor, tracked as UNC2814, is a hacking group GTIG says it has monitored since 2017.
“This prolific, elusive actor has a long history of targeting international governments and global telecommunications organizations across Africa, Asia and the Americas, and had confirmed intrusions in 42 countries when the disruption was executed,” the statement said.
...
According to Google, the group relied on a common tactic involving application programming interfaces, or APIs—the tools that allow software programs to communicate with one another. By sending legitimate-looking requests between systems, the hackers were able to blend into normal network traffic.
Rather than exploiting obvious security flaws, the group allegedly used trusted cloud-hosted services to mask its activity, making malicious operations appear routine and harder to detect.
Google said past activity linked to UNC2814 included surveillance of Chinese dissidents, activists and civil society figures abroad. In some cases, the group is believed to have targeted individuals critical of Beijing, using phishing campaigns and network intrusions to monitor communications and gather intelligence.
The activity fits a broader pattern in which overseas critics of the Chinese government, including democracy advocates and human rights campaigners, have reported digital harassment, account compromise attempts and coordinated online pressure campaigns.
Influence Campaigns
On Wednesday, OpenAI said it had banned accounts linked to a network it assessed as tied to Chinese law enforcement after the users allegedly attempted to leverage GPT models in an influence campaign targeting “domestic and foreign adversaries.” According to the company, the activity involved generating politically themed content and narratives for dissemination online. One target was Japanese political figure Sanae Takaichi, though OpenAI said its models refused certain requests.
Chinese Foreign Ministry spokesperson Mao Ning told reporters Thursday she was not familiar with the situation and saw no basis for the accusation.
Investigators said the evidence suggested the existence of earlier state-supported influence operations spanning multiple platforms, including Chinese-built AI models, and thousands of falsified accounts, with tactics ranging from spam posting to impersonating U.S. officials in order to intimidate critics.
Distillation Attacks
Three Chinese AI labs—DeepSeek, MiniMax and Moonshot AI— were found to have used a technique known as “distillation” to extract capabilities from Claude, a family of LLMS created by Anthropic, the U.S. AI research firm said in a Monday report.
Distillation, or training a smaller or newer model on outputs generated by a more advanced system, is a common industry practice. However, the Chinese labs reportedly carried out more than 16 million exchanges with Claude using roughly 24,000 fraudulent accounts, violating its terms of service and regional access restrictions.
Models derived through unauthorized distillation lack many of the original system’s guardrails, such as those designed to limit misuse for cybercrime or bioweapons development, and can pose national security risks, Anthropic said.
What People Are Saying
The U.S. House Select Committee on Strategic Competition between the U.S. and the Chinese Communist Party said in a statement Wednesday: “China is weaponizing AI to suppress critics abroad, impersonating U.S. officials, faking obituaries, and coordinating thousands of fake accounts. This is industrialized transnational repression.”
Anthropic wrote: "We continue to invest heavily in defenses that make such distillation attacks harder to execute and easier to identify. But no company can solve this alone. As we noted above, distillation attacks at this scale require a coordinated response across the AI industry, cloud providers, and policymakers. "
What Happens Next
The news is likely to intensify scrutiny of China’s cyber and influence operations. Beijing has historically rejected such accusations and often countered by pointing to U.S.-funded information campaigns of its own.
View 0 Comments
Submit Correction
View Editorial & AI Guidelines