NZ calls China its most persistent cyberthreat

China is New Zealand’s most persistent and capable state-backed cyberthreat, as foreign actors targeted government agencies and organizations in sectors including health, education and information technology, the National Cyber Security Centre (NCSC) said in a report released yesterday.

The center, part of the New Zealand intelligence community, said it had identified activity suspected to originate from foreign state actors that put sensitive New Zealand information at risk.

It linked suspected state-sponsored cyberactivity to actors from China, Russia, Iran and North Korea, according to its annual Cyber Threat Report.

New Zealand and Chinese flags hang over surveillance cameras on a pole near Tiananmen Square in Beijing on June 19 last year.

Photo: Reuters

“Of these nations the People’s Republic of China is the most persistent and capable state actor undertaking cyberactivity in New Zealand,” the report said.

The assessment is the latest warning from a Western-aligned intelligence agency over alleged Chinese cyberespionage, which Beijing has routinely denied. It follows a report release last month by the New Zealand Security Intelligence Service that said that China was the only country New Zealand had detected conducting espionage “at scale.”

“China urges the relevant institution in New Zealand to stop spreading lies and creating conflict and to do more to foster mutual understanding and trust between China and New Zealand,” a Chinese Ministry of Foreign Affairs spokesperson said when asked about the report.

“China always opposes and resolutely cracks down on hacking attacks in accordance with law,” they said during a regular briefing.

The cybersecurity report said that 86 of 369 cyberincidents deemed to be of potential national significance in the year to June had suspected links to state-sponsored actors.

The incidents included activity targeting government agencies, health and education organizations and information technology managed-service providers.

The agency warned that geopolitical competition was increasingly playing out in the South Pacific, where it was aware of state-backed cyberespionage targeting governments and infrastructure.

New Zealand has close family, cultural, political and economic ties across the Pacific, and such activity could affect citizens, businesses and civic institutions, it said.

State-backed actors were likely to target organizations that operate infrastructure or networks, provide essential public services or hold information that could offer a strategic advantage, the NCSC said.

It said that cyberespionage can be difficult to detect, with actors conducting reconnaissance and positioning access in systems over months or years before using it for intelligence gathering or disruption.

Long-running intrusions could lead to the compromise of operational technology and the loss of corporate and personal data, it said.