Chinese Hackers 'Targeted Kenyan Ministries Amid Debt Strains'

Chinese hackers are suspected to have targeted the Kenyan government in a years-long effort apparently aimed at finding information about the country’s debt status.

Key Kenyan ministries and state institutions were subject to a series of digital intrusions over the past four years, according to three sources, plus cybersecurity research reports and an analysis of technical data related to the hacks.

Two of the sources assessed the hacks to be aimed, at least in part, at gaining information on debt owed to Beijing by the East African nation.

Kenya is a strategic link in the Belt and Road Initiative – President Xi Jinping’s trillion-dollar scheme for a global infrastructure network.

“Further compromises may occur as the requirement for understanding upcoming repayment strategies becomes needed,” a July 2021 research report written by a defence contractor for private clients stated.

ALSO SEE:

China Warns Japan to Reverse its Ban on Chipmaking Gear

‘Hacks monitor China’s strategic investments’

China’s foreign ministry said it was “not aware” of any such hacking, while China’s embassy in Britain called the accusations “baseless”, adding that Beijing opposes and combats “cyberattacks and theft in all their forms.”

China’s influence in Africa has grown rapidly over the past two decades. But, like several African nations, Kenya’s finances are being strained by the growing cost of servicing external debt – much of it owed to China.

The hacking campaign demonstrates China’s willingness to leverage its espionage capabilities to monitor and protect economic and strategic interests abroad, two of the sources said.

The hacks constitute a three-year campaign that targeted eight of Kenya’s ministries and government departments, including the presidential office, according to an intelligence analyst in the region.

The analyst shared research documents that included a timeline of attacks, the targets, and provided some technical data relating to the compromise of a server used exclusively by Kenya’s main spy agency.

A Kenyan cybersecurity expert described similar hacking activity against the foreign and finance ministries. All three of the sources asked not to be named due to the sensitive nature of their work.

A view of the Kenyan capital Nairobi near the expressway built by China Road and Bridge Corporation (Reuters). Kenyan ministries were subject to hacks apparently seeking knowledge about its capacity to repay debts to China, sources claim.

Frequent hacking bids from several sources: Kenya

“Your allegation of hacking attempts by Chinese Government entities is not unique,” Kenya’s presidential office said, adding the government had been targeted by “frequent infiltration attempts” from Chinese, American and European hackers.

“As far as we are concerned, none of the attempts were successful,” it said.

It did not provide further details nor respond to follow-up questions.

A spokesperson for the Chinese embassy in Britain said China is against “irresponsible moves that use topics like cyber-security to sow discord in the relations between China and other developing countries”.

“China attaches great importance to Africa’s debt issue and works intensively to help Africa cope with it,” the spokesperson added.

$160 billion in loans to African nations

Between 2000 and 2020, China committed nearly $160 billion in loans to African countries, according to a comprehensive database on Chinese lending hosted by Boston University, much of it for large-scale infrastructure projects.

Kenya used over $9 billion in Chinese loans to fund an aggressive push to build or upgrade railways, ports and highways.

Beijing became the country’s largest bilateral creditor and gained a firm foothold in the most important East African consumer market and a vital logistical hub on Africa’s Indian Ocean coast.

By late 2019, however, when the Kenyan cybersecurity expert said he was brought in by Kenyan authorities to assess a hack of a government-wide network, Chinese lending was drying up. And Kenya’s financial strains were showing.

Persistent hacks focused on Kenya’s debts

The breach reviewed by the Kenyan cybersecurity expert and attributed to China began with a “spearphishing” attack at the end of that same year, when a Kenyan government employee unknowingly downloaded an infected document, allowing hackers to infiltrate the network and access other agencies.

“A lot of documents from the ministry of foreign affairs were stolen and from the finance department as well. The attacks appeared focused on the debt situation,” the Kenyan cybersecurity expert said.

Another source – the intelligence analyst working in the region – said Chinese hackers carried out a far-reaching campaign against Kenya that began in late 2019 and continued until at least 2022.

According to documents provided by the analyst, Chinese cyber spies subjected the office of Kenya’s president, its defence, information, health, land and interior ministries, its counter-terrorism centre and other institutions to persistent and prolonged hacking activity.

The affected government departments did not respond to requests for comment, declined to be interviewed or were unreachable.

By 2021, global economic fallout from the Covid-19 pandemic had already helped push one major Chinese borrower – Zambia – to default on its external debt. Kenya managed to secure a temporary debt repayment moratorium from China.

Hackers accessed Kenyan intelligence server

In early July 2021, the cybersecurity research reports shared by the intelligence analyst in the region detailed how the hackers secretly accessed an email server used by Kenya’s National Intelligence Service (NIS).

Reuters confirmed that the victim’s IP address belonged to the NIS. The incident was also covered in a report from the private defence contractor.

Reuters could not determine what information was taken during the hacks or conclusively establish the motive for the attacks. But the defence contractor’s report said the NIS breach was possibly aimed at gleaning information on how Kenya planned to manage its debt payments.

“Kenya is currently feeling the pressure of these debt burdens…as many of the projects financed by Chinese loans are not generating enough income to pay for themselves yet,” the report stated.

A review of internet logs delineating the Chinese digital espionage activity showed that a server controlled by the Chinese hackers also accessed a shared Kenyan government webmail service more recently from December 2022 until February this year.

Chinese and Kenyan officials declined to comment on this recent breach.

State hacking team: ‘Backdoor Diplomacy’

The defence contractor, pointing to identical tools and techniques used in other hacking campaigns, identified a Chinese state-linked hacking team as having carried out the attack on Kenya’s intelligence agency.

The group is known as “BackdoorDiplomacy” in the cybersecurity research community, because of its record of trying to further the objectives of Chinese diplomatic strategy.

According to Slovakia-based cybersecurity firm ESET, BackdoorDiplomacy re-uses malicious software against its victims to gain access to their networks, making it possible to track their activities.

Provided with an IP address of the NIS hackers, Palo Alto Networks, a US cybersecurity firm that tracks BackdoorDiplomacy’s activities, confirmed that it belongs to the group, adding that its prior analysis shows the group is sponsored by the Chinese state.

Cybersecurity researchers have documented BackdoorDiplomacy hacks targeting governments and institutions in a number of countries in Asia and Europe.

Incursions into the Middle East and Africa appear less common, making the focus and scale of its hacking activities in Kenya particularly noteworthy, the defence contractor’s report said.

“This angle is clearly a priority for the group.”

China’s embassy in Britain rejected any involvement in the Kenya hackings, and did not directly address questions about the government’s relationship with BackdoorDiplomacy.

“China is a main victim of cyber theft and attacks and a staunch defender of cybersecurity,” a spokesperson said.