Palau, a group of about 350 small Pacific islands, has become increasingly important to the United States as China seeks to expand its influence in the Indo-Pacific region. Washington this year finalized a long-delayed plan to give Palau hundreds of millions of dollars in aid over 20 years.
Hours before diplomats gathered at the US Embassy in Palau to celebrate the agreement, the island nation was hit by a massive cyber attack in which more than 20,000 government documents were stolen.
A few weeks later, in April, they appeared on the dark web: There was a presentation about a U.S. military radar facility in Palau, marked “for official use only,” a crew list for a Japanese naval vessel that had visited Palau, and hundreds of documents detailing close ties between Palau and Taiwan.
Palau is one of the few countries in the world that recognizes Taiwan as an independent democracy. Palau’s leaders say the hack was orchestrated by China, which claims Taiwan as its territory, and was designed to send a message. China is lobbying other countries, including another Pacific nation, Nauru, to sever ties with Taiwan.
China denies the accusations, and experts say Palau has not presented any evidence implicating China. A ransomware group called Dragonforce claimed responsibility and said the hack was purely financially motivated. The group has threatened further harm to Palau.
Whatever the motive, the intrusion poses a danger to the U.S. Experts say the hackers could use the information they gain to launch more sophisticated phishing attacks. Whether or not DragonForce acted alone, the incident is a reminder of the threat posed by mercenary hackers.
Palau authorities, which is home to U.S. military facilities and occupies a key shipping lane used to defend Taiwan in the event of a conflict, say the attack is politically motivated and that China is behind it.
“Everything points in that direction,” Palau President Srangell Whipps Jr. said in an interview. “It’s unfortunate that China would do something like this,” he said, adding that Palau’s relationship with Taiwan “has never been stronger.”
“Palau is extremely irresponsible in jumping to conclusions without valid evidence and making groundless accusations and smears against China,” China’s foreign ministry said in a statement.
Palau, located about 550 miles east of the Philippines, was under U.S. rule for decades after World War II. It gained independence in 1994 but maintains close ties with the U.S. through an agreement known as “free association,” which gives Palauans the right to work, live and study in the U.S. and allows the U.S. to provide funding to the local government and military access to the archipelago, which is home to about 20,000 people. Its closest neighbors, Micronesia and the Marshall Islands, have similar relationships with the U.S.
Palau is set to receive about $900 million in aid from the United States over 20 years, but approval of the deal was delayed for several months, raising concerns that China could gain dominance in the region.
Taiwan also provides financial assistance to Palau, and some of the leaked documents show that Taiwan has funded Palau’s participation in international forums such as the United Nations and the COP climate change summits – meetings from which Taiwan has been excluded due to Beijing’s objections.
Most countries treat Taiwan as a sovereign nation, but only a few officially recognize it. The United States describes its relationship with Taiwan as a “robust informal relationship.” Asked for comment on the Palau incursion, a Pentagon spokesman referred questions to U.S. Cyber Command, which declined to comment.
The leaked documents may also pose risks to other countries. They include diplomatic communications with countries such as Japan, Israel and the United States dating back to the mid-2000s. The identities of senior Japanese officials, US military personnel and Saudi Arabian diplomatic missions were also posted online.
“If Japan and Taiwan are not careful, there could be repercussions,” said Hideyuki Shiozawa, a former diplomat and Pacific expert at the Sasakawa Peace Foundation in Tokyo, referring to cybersecurity vulnerabilities in the Pacific islands.
A Palau official said the hack was political because Dragonforce made no effort to negotiate a ransom, and Jay Anson, chief information security officer for the Palau Ministry of Finance, said Beijing used the ransomware group to mitigate the risk of diplomatic trouble with Washington.
“We determined that they must have been taking money from somebody to make this happen,” said Anson, of the ministry where the documents were stolen. “It was a political issue, not a financial issue.”
Experts said while Palau may have been targeted by China, it was unusual for the country to subcontract cyber attacks to a ransomware group.
John DiMaggio, a former U.S. intelligence analyst who is now chief security strategist at cybersecurity firm Analyst 1, said he has seen the documents and that anything related to Taiwan could be of interest to China. He said Palau authorities had not shared details with the experts that would support the allegations, but added that one reason a state actor might use a group like Dragon Force rather than covert espionage would be to publicly embarrass a target.
“If they were using a ransomware group as a contractor, there must be a motive because they knew it would be big and visible,” he said. “If they were intentionally trying to make that point, that’s possible.”
Alan Liska, an analyst at cybersecurity firm Recorded Future, agreed that the motive was plausible, though he said Palau needed to share more details to convince himself and others of its version. “If propaganda was the goal, the nature of the ransomware hack and data leak fits that description,” he added.
“The Chinese government has been working to improve the situation in Palau for many years, and we are committed to working with them to achieve this goal,” said the Chinese Foreign Ministry, which has been working to improve Palau’s internal affairs since 2013.
“He called me and said, ‘You’re a businessman. Do you understand the potential of China? If you need a million tourists, we can provide you with a million tourists. We can build all the hotels you need. This is economic basics. We have a population of 1.5 billion and Taiwan has a population of 22 million,'” Whipps recalled.
The ambassador then accused Palau of illegal activities, Whipps said. When Whipps asked what those were, the Chinese official replied, “We recognize Taiwan.”
Olivia Wang and David Pearson He contributed a report from Hong Kong. Julian Barnes From Washington.
