From Prague to Wuhan: the Czech Republic accused China of long-term espionage

Behind the cyberattacks on Czech The Ministry of Foreign Affairs, which began in 2022, stands China, the Czech government announced on Wednesday (May 28).

Thousands of confidential emails were compromised during the attack, the Czech government said in an official statement.

Since 2022, the Czech Ministry of Foreign Affairs has been targeted by the Chinese hacking group APT31, which is believed to be operating with state support. In the same year, the Czech Republic presided over the Council EU, due to which the Chinese hacker group had access to non-public emails exchanged between embassies and EU institutions, according to the statement.

Czech Foreign Minister Jan Lipavsky said he would immediately call the Chinese ambassador to present the findings to him and warn him that this would jeopardize bilateral relations between the two countries.

"With today's move, we have exposed China, which has been working to undermine our resilience and democracy for a long time. Through cyber attacks, manipulation of information and propaganda, it interferes in our society, and we have to defend ourselves against it," Lipavski said.

China is interfering in our society - through manipulation, propaganda, and cyberattacks.
Like the recent one against @CzechMFA. We detected the attackers during the intrusion.
Our key security institutions responded, investigated thoroughly – and now we're going public.
He said... pic.twitter.com/AvHTBGOthN

— Jan Lipavský (@JanLipavsky) May 28, 2025

This is the first time that the Czech government has officially attributed a cyber attack to a state actor.

The investigation was carried out by the Security and Information Service, the Military Intelligence Service, the Office of Foreign Relations and Information and the National Agency for Cyber ​​and Information Security (NUKIB), and the results provided the Czech authorities with a high degree of certainty about who was behind the attack, Politiko writes.

China has not yet made an official statement regarding the Czech government's accusations.

Who are APT31?

According to the US Department of Justice, the APT31 group is controlled by the Chinese Ministry of State Security from the city of Wuhan.

The group has previously been accused of a series of high-profile attacks, including an attempt to compromise the personal emails of members of the 2020 US presidential candidate Joe Biden's campaign.

In 2024, the United Kingdom and the United States imposed sanctions on individuals associated with APT31.

EU and NATO react

The alleged Chinese cyber attack has sparked outrage among European Union leaders and NATO headquarters in Brussels.

"The European Union and its member states, together with international partners, express their solidarity with the Czech Republic over the malicious cyber campaign targeting its Ministry of Foreign Affairs," the EU High Representative for Foreign Affairs, Kaja Kalas, said in a statement.

"We call on all states, including China, to refrain from such behavior, to respect international law and to abide by the norms and principles of the United Nations, including those related to critical infrastructure," Kalas added.

"Cyber ​​actors are persistently trying to destabilize the Alliance. We remain committed to uncovering and countering significant, persistent and growing cyber threats, including those targeting our democratic systems and critical infrastructure. We are determined to further enhance our capabilities and resilience, and to deploy all available capabilities to deter, defend and counter all types of cyber threats in mutual support," NATO said Wednesday.

Sources: Politico