Sources: Chinese-backed hackers breached Japanese cybersecurity agency NISC's email system; experts link the July 4 ransomware attack on Port of Nagoya to China

Infiltration comes as allies scrutinise Tokyo's defences against hacking — The organisation responsible for Japan's national defences …

Financial Times 2023-08-30 Leo Lewis

Context & Ripple Effects

The reported NISC compromise extends a pattern of concern over Japanese defense-network exposure: coverage earlier in August said Chinese hackers had access to those networks from 2020 into at least 2021, a previously reported defense-network intrusion.

The Port of Nagoya disruption had already forced the port to plan a rapid operational restart after the July 4 ransomware incident. The new reported China link turns what had been an unclaimed disruption into a more consequential question of state-linked cyber risk to Japanese infrastructure.

First-order effects

NISC must assess the scope of email-system access and tighten remediation around an agency central to Japan’s national cyber defenses; the report also gives allies a concrete reason to scrutinize those defenses.
For the Port of Nagoya, the reported expert attribution raises the stakes beyond recovery from the July ransomware outage, putting greater focus on whether operational networks were exposed to a China-linked campaign.

Second-order effects

US-Japan cyber coordination is likely to concentrate more heavily on identifying persistent access and hardening network edge devices, consistent with the later warning that BlackTech was installing backdoors through network devices.
Operators of ports and other critical infrastructure face added pressure to treat ransomware resilience and nation-state intrusion detection as connected requirements rather than separate security problems.

Third-order effects

If repeated intrusions across government and infrastructure are confirmed, Japan’s cyber posture may shift further from incident-by-incident response toward sustained threat hunting and alliance-based intelligence sharing.
The pattern would blur the practical boundary between espionage and disruptive cybercrime: access to strategic systems can create operational risk even when an attacker’s immediate objective is intelligence collection.

The trend: This is one data point in the convergence of China-linked cyber espionage, critical-infrastructure disruption, and tighter allied cyber-defense coordination in Japan.

Discussion

@shashj Shashank Joshi on x
Oh dear. “The organisation responsible for Japan's national defences against cyber attacks has itself been infiltrated by hackers, who may have gained access to sensitive data for as much as nine months” https://www.ft.com/...
@matthew_pines Matthew Pines on x
Among the many reasons why Japan will never join FVEY is their shambolic counterintelligence and cybersecurity capabilities. Exhibit A:
@war_student William Reynolds on x
The digital culture/security of partners in Japan is likely going to be a point to watch when it comes to smoothing lines of communication at a Gov to Gov and industry to industry level to facilitate GCAP
@johnnysaks130 John Sakellariadis on x
Interesting: FT's description of a major breach at a key Japanese cyber agency lines up almost perfectly with recent Mandiant reporting on a *pretty remarkable* Chinese cyber espionage campaign against Barracuda email security gateways. https://www.ft.com/...
@lukolejnik Lukasz Olejnik on x
Reportedly, China's cyber operators hacked Japan's cybersecurity agency (Japan's National Center of Incident Readiness and Strategy for Cybersecurity). They were inside for 9 months, with access to sensitive data. This looks very bad. https://www.ft.com/... [image]
@danwblack Dan Black on x
“In July, an attack that was disguised as a ransomware incident temporarily closed down the port of Nagoya. It has since been assessed by government cyber experts as part of a “persistent testing of Japan's infrastructural defences by China”.”

Chronicles