Amnesty International Canada says it was targeted by Chinese cyberespionage threat groups

The Canadian branch of the human rights group Amnesty International suffered a cyber attack that, it believes, was carried out by a Chinese hacking group.

In a recent statement, the organisation said that it identified “suspicious activity” in its internal network on October 5 and immediately launched an investigation to determine the scale and scope of the breach.

“Amnesty International Canada engaged a highly skilled team of forensic investigators and cyber security experts who took immediate action to protect the organization’s systems and investigate the source of the attack,” the statement read.

The agency’s preliminary investigation revealed that the security breach was carried out using tools and techniques associated with specific advanced persistent threat groups (APTs). Experts at cyber-security firm Secureworks later confirmed that “a threat group sponsored or tasked by the Chinese state” was likely behind the attack.

“The forensic audit’s conclusion is based “on the nature of the targeted information as well as the observed tools and behaviours, which are consistent with those associated with Chinese cyberespionage threat groups,” Amnesty International added.

In a statement, Ketty Nivyabandi, secretary general of Amnesty International Canada, said, “As an organisation advocating for human rights globally, we are very aware that we may be the target of state-sponsored attempts to disrupt or surveil our work. These will not intimidate us and the security and privacy of our activists, staff, donors, and stakeholders remain our utmost priority.

“This case of cyber espionage speaks to the increasingly dangerous context that activists, journalists, and civil society alike must navigate today. Our work to investigate and denounce these acts has never been more critical and relevant. We will continue to shine a light on human rights violations wherever they occur and to denounce the use of digital surveillance by governments to stifle human rights,” she added.

Since the attack, Amnesty International Canada has taken steps to strengthen its digital security and restore systems back online securely. The organisation has notified law enforcement authorities, staff, donors, and other stakeholders about the security breach.

While the organisation said that it found no evidence of any donor or membership data being exfiltrated, the possibility of the same cannot be ruled out.

Commenting on the news, Javvad Malik, lead security awareness advocate at KnowBe4, said, “While details are scarce at the moment, it’s important to remember that most criminals and state-sponsored APT groups will typically infiltrate organisations via spear phishing, exploiting unpatched vulnerabilities, or through weak credentials.

“Therefore, as the first line of defence, if organisations address these main areas by having a patch management plan in place, by deploying MFA, and providing user awareness and training to spot phishing emails which make it into their inbox and provide ways to report, then it can greatly reduce the likelihood of being successfully attacked,” he added.