Federal Public Service of the Interior

Summary

Hackers breached the Belgian Interior Ministry's network in an intrusion discovered during a later investigation into vulnerabilities in Exchange email servers following warnings about a known hacking group. The attackers employed sophisticated, targeted methods indicative of espionage, with evidence suggesting the compromise extended back years rather than being limited to recent activity. While initial reports attributed the breach to a specific nation-state actor, authorities declined to confirm this attribution. The discovery coincided with broader cybersecurity challenges faced by the government, including a separate disruptive DDoS attack impacting parliamentary operations.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

In April 2019, hackers breached the network of Belgium’s Federal Public Service Interior (interior ministry), though the intrusion remained undetected until March 2021. The discovery occurred during an investigation into the ministry’s Microsoft Exchange email servers following Microsoft’s warnings about attacks by Hafnium, a Chinese state-sponsored hacking group. While assessing vulnerabilities and applying patches to Exchange servers, IT personnel identified anomalous activity extending beyond the Hafnium-related compromises. Forensic analysis revealed signs of a prior breach dating back to the 2019 period, indicating the attackers had maintained persistent access for approximately two years. Officials characterized the intrusion as highly targeted, with tactics consistent with espionage objectives, and noted the operation’s complexity suggested advanced capabilities and substantial resources. The attackers’ specific actions within the network were not detailed, nor were the exact data exfiltrated or systems compromised disclosed publicly.

Belgian authorities, assisted by the Centre for Cyber Security Belgium (CCB), investigated the breach but did not formally attribute it to any nation or group. Initial media reports alleging Chinese involvement were retracted after officials declined to confirm the attribution. The disclosure coincided with the Belgian government’s approval of a renewed national cybersecurity strategy emphasizing enhanced protections for critical government infrastructure. Separately, around the same time as the breach’s announcement, Belgium experienced a disruptive DDoS attack that impaired government systems on a day when Parliament was scheduled to hear testimony regarding human rights abuses in China’s Xinjiang region. The interior ministry did not publicly detail remediation steps beyond the initial server patching, and the CCB offered no additional commentary on the 2019 incident’s resolution or ongoing impacts.

Sources

Sources available to members: 1 source.