Chinese hackers attacked Kenyan govt as debt strains grew

Chinese hackers targeted Kenya's government in a widespread, years-long series of digital intrusions against key ministries and state institutions, according to three sources, cybersecurity research reports and Reuters' own analysis of technical data related to the hackings.

Two of the sources assessed the hacks to be aimed, at least in part, at gaining information on debt owed to Beijing by the East African nation: Kenya is a strategic link in the Belt and Road Initiative - President Xi Jinping's plan for a global infrastructure network.

"Further compromises may occur as the requirement for understanding upcoming repayment strategies becomes needed," a July 2021 research report written by a defence contractor for private clients stated.

China's foreign ministry said it was "not aware" of any such hacking, while China's embassy in Britain called the accusations "baseless", adding that Beijing opposes and combats "cyberattacks and theft in all their forms."

China's influence in Africa has grown rapidly over the past two decades. But, like several African nations, Kenya's finances are being strained by the growing cost of servicing external debt - much of it owed to China.

The hacking campaign demonstrates China's willingness to leverage its espionage capabilities to monitor and protect economic and strategic interests abroad, two of the sources said.

The hacks constitute a three-year campaign that targeted eight of Kenya's ministries and government departments, including the presidential office, according to an intelligence analyst in the region. The analyst also shared with Reuters research documents that included the timeline of attacks, the targets, and provided some technical data relating to the compromise of a server used exclusively by Kenya's main spy agency.

A Kenyan cybersecurity expert described similar hacking activity against the foreign and finance ministries. All three of the sources asked not to be named due to the sensitive nature of their work.

"Your allegation of hacking attempts by Chinese Government entities is not unique," Kenya's presidential office said, adding the government had been targeted by "frequent infiltration attempts" from Chinese, American and European hackers.

"As far as we are concerned, none of the attempts were successful," it said.

It did not provide further details nor respond to follow-up questions.

A spokesperson for the Chinese embassy in Britain said China is against "irresponsible moves that use topics like cybersecurity to sow discord in the relations between China and other developing countries".

"China attaches great importance to Africa's debt issue and works intensively to help Africa cope with it," the spokesperson added.

The hacks

Between 2000 and 2020, China committed nearly US$160 billion (about RM734.6 billion) in loans to African countries, according to a comprehensive database on Chinese lending hosted by Boston University, much of it for large-scale infrastructure projects.

Kenya used over US$9 billion in Chinese loans to fund an aggressive push to build or upgrade railways, ports and highways.

Beijing became the country's largest bilateral creditor and gained a firm foothold in the most important East African consumer market and a vital logistical hub on Africa's Indian Ocean coast.

By late 2019, however, when the Kenyan cybersecurity expert told Reuters he was brought in by Kenyan authorities to assess a hack of a government-wide network, Chinese lending was drying up. And Kenya's financial strains were showing.

The breach reviewed by the Kenyan cybersecurity expert and attributed to China began with a "spearphishing" attack at the end of that same year, when a Kenyan government employee unknowingly downloaded an infected document, allowing hackers to infiltrate the network and access other agencies.

"A lot of documents from the ministry of foreign affairs were stolen and from the finance department as well. The attacks appeared focused on the debt situation," the Kenyan cybersecurity expert said.

Another source - the intelligence analyst working in the region - said Chinese hackers carried out a far-reaching campaign against Kenya that began in late 2019 and continued until at least 2022.

According to documents provided by the analyst, Chinese cyber spies subjected the office of Kenya's president, its defence, information, health, land and interior ministries, its counter-terrorism centre and other institutions to persistent and prolonged hacking activity.

The affected government departments did not respond to requests for comment, declined to be interviewed or were unreachable.

By 2021, global economic fallout from the Covid-19 pandemic had already helped push one major Chinese borrower - Zambia - to default on its external debt. Kenya managed to secure a temporary debt repayment moratorium from China.

In early July 2021, the cybersecurity research reports shared by the intelligence analyst in the region detailed how the hackers secretly accessed an email server used by Kenya's National Intelligence Service (NIS).

Reuters was able to confirm that the victim's IP address belonged to the NIS. The incident was also covered in a report from the private defence contractor reviewed by Reuters.

Reuters could not determine what information was taken during the hacks or conclusively establish the motive for the attacks. But the defence contractor's report said the NIS breach was possibly aimed at gleaning information on how Kenya planned to manage its debt payments.

"Kenya is currently feeling the pressure of these debt burdens... as many of the projects financed by Chinese loans are not generating enough income to pay for themselves yet," the report stated.

A Reuters review of internet logs delineating the Chinese digital espionage activity showed that a server controlled by the Chinese hackers also accessed a shared Kenyan government webmail service more recently from December 2022 until February this year.

Chinese officials declined to comment on this recent breach, and the Kenyan authorities did not respond to a question about it.

'Backdoor diplomacy'

The defence contractor, pointing to identical tools and techniques used in other hacking campaigns, identified a Chinese state-linked hacking team as having carried out the attack on Kenya's intelligence agency.

The group is known as "BackdoorDiplomacy" in the cybersecurity research community, because of its record of trying to further the objectives of Chinese diplomatic strategy.

According to Slovakia-based cybersecurity firm ESET, BackdoorDiplomacy re-uses malicious software against its victims to gain access to their networks, making it possible to track their activities.

Provided by Reuters with the IP address of the NIS hackers, Palo Alto Networks, a US cybersecurity firm that tracks BackdoorDiplomacy's activities, confirmed that it belongs to the group, adding that its prior analysis shows the group is sponsored by the Chinese state.

Cybersecurity researchers have documented BackdoorDiplomacy hacks targeting governments and institutions in a number of countries in Asia and Europe.

Incursions into the Middle East and Africa appear less common, making the focus and scale of its hacking activities in Kenya particularly noteworthy, the defence contractor's report said.

"This angle is clearly a priority for the group."

China's embassy in Britain rejected any involvement in the Kenya hackings, and did not directly address questions about the government's relationship with BackdoorDiplomacy.

"China is a main victim of cyber theft and attacks and a staunch defender of cybersecurity," a spokesperson said.