Amnesty International Canada hit by China-linked cyberattack

The Canadian branch of human rights organization Amnesty International announced it was targeted in a cyberattack believed to be linked to Beijing.

The breach was first detected on October 5, with forensic investigators hired to investigate its nature.

What hinted towards China were exclusively country-related searches conducted by attackers within the system. As such, all of them concerned Chinese activists, Hong Kong, and China itself.

“As an organization advocating for human rights globally, we are very aware that we may be the target of state-sponsored attempts to disrupt or surveil our work. These will not intimidate us and the security and privacy of our activists, staff, donors, and stakeholders remain our utmost priority,” Ketty Nivyabandi, Secretary General of Amnesty International Canada, said.

According to Amnesty, the incident was associated with specific advanced persistent threat groups (APTs). Russia, China, the USA, and North Korea all have APT groups in charge of targeting enemy states and organizations. For instance, China’s Double Dragon, active since 2012, has been involved in cyber espionage against 14 countries.

Later findings from forensic experts with international cybersecurity firm Secureworks confirmed the likelihood of the attack being linked to “a threat group sponsored or tasked by the Chinese state.” There were no financial demands or other attempts to profit from the hack.

According to the hired experts, their findings are based “on the nature of the targeted information as well as the observed tools and behaviors, which are consistent with those associated with Chinese cyberespionage threat groups.”

Back in 2021, BlackBerry researchers already recorded an increase in mercenary APT groups now being in charge of cyber espionage. Nation states commonly opt for those groups to hide behind their identities.

Nivyabandi reminded activists and organizations to strengthen their defenses and noted the importance of Amnesty’s work.

“This case of cyber espionage speaks to the increasingly dangerous context which activists, journalists, and civil society alike must navigate today,” Nivyabandi said. “Our work to investigate and denounce these acts has never been more critical and relevant. We will continue to shine a light on human rights violations wherever they occur and to denounce the use of digital surveillance by governments to stifle human rights.”