In a statement released in parallel with a statement released by the Council of the European Union, the MFA said "Latvia in its national capacity, reinforces the international community’s condemnation of attacks taking advantage of the Microsoft Exchange Server vulnerabilities, which have undermined security and stability in cyberspace and caused significant economic loss. The EU and its Member States also have been targeted by hacker groups APT40 and APT31, which are involved in intellectual property theft and espionage. The EU and its Member States have assessed that those malicious cyber activities and compromising of the Microsoft Exchange server have been undertaken from the territory of the People's Republic of China."
Both the Latvian and EU statements are careful not to explicitly accuse the ruling Chinese communist party or Chinese state of being directly behind the cyber-attacks, instead making the distinction that they appear to have emanated from Chinese territory.
"Latvia strongly advocates the applicability of international law and norms in cyberspace and calls on the People's Republic of China to adhere, as all states should, to the framework for responsible state behavior in cyberspace, including by not allowing its territory to be used for malicious cyber activities," the Latvian MFA said.
"Latvia will continue to promote free, open, stable and secure cyberspace and international cooperation seeking to collectively strengthen security in cyberspace and deter further cyber-attacks," it added.
According to the EU statement: "The compromise and exploitation of the Microsoft Exchange server undermined the security and integrity of thousands of computers and networks worldwide, including in the member states and EU institutions. It allowed access to a significant number of hackers that have continued to exploit the compromise to date. This irresponsible and harmful behaviour resulted in security risks and significant economic loss for our government institutions and private companies, and has shown significant spill-over and systemic effects for our security, economy and society at large."
"We have also detected malicious cyber activities with significant effects that targeted government institutions and political organisations in the EU and member states, as well as key European industries. These activities can be linked to the hacker groups known as Advanced Persistent Threat 40 and Advanced Persistent Threat 31 and have been conducted from the territory of China for the purpose of intellectual property theft and espionage.
"The EU and its member states strongly denounce these malicious cyber activities, which are undertaken in contradiction with the norms of responsible state behaviour as endorsed by all UN member states. We continue to urge the Chinese authorities to adhere to these norms and not allow its territory to be used for malicious cyber activities, and take all appropriate measures and reasonably available and feasible steps to detect, investigate and address the situation."
