Suspected Chinese Hackers Target Microsoft Email Servers, Focus on Diplomatic Data

Palo Alto Networks researchers uncovered a cyberespionage campaign by a group dubbed Phantom Taurus, suspected to be Chinese state-affiliated actors. The hackers compromised Microsoft Exchange servers belonging to foreign ministries, specifically targeting diplomatic correspondence related to the 2022 China-Arab summit and communications mentioning Chinese leadership.

The three-year operation aligns with Beijing's geopolitical interests, with exfiltrated data including military and embassy communications. China's embassy in Washington dismissed the allegations, maintaining its opposition to all cyberattacks while citing attribution challenges in digital space.

This incident follows recent warnings from Alphabet about similar activity, highlighting escalating cyber tensions between global powers. The breach demonstrates sophisticated targeting of governmental communication channels rather than financial infrastructure.