Brussels, Belgium – The Belgian federal prosecutor’s office has launched an investigation into a major cybersecurity breach targeting the country’s State Security Service (VSSE), with suspicions that Chinese state-backed hackers orchestrated the attack.
The breach, which remained undetected for nearly two years, compromised an external email server used by VSSE, exposing sensitive government communications.
According to reports from Belgian news outlets Le Soir and The Brussels Times, the attack took place between 2021 and May 2023, during which around 10% of all emails sent and received by the agency’s staff were siphoned off.
The infiltrated server was primarily used for exchanging emails with Belgian public prosecutors, government ministries, law enforcement, and other administrative bodies.
Internal HR communications were also routed through the compromised server, potentially exposing personal data, including identity documents and CVs, belonging to nearly half of VSSE’s current staff and past applicants.
The cyberattack coincided with Belgium’s extensive recruitment drive to expand its intelligence workforce. An anonymous intelligence source quoted by Le Soir likened the situation to buying a “bulletproof vest, only to find a gaping hole in it.”
Barracuda ESG Vulnerability Suspected
Investigators believe the breach is linked to a zero-day vulnerability in Barracuda’s Email Security Gateway (ESG) appliance, exploited in global cyber-espionage operations.
In May 2023, cybersecurity firm Barracuda disclosed that attackers had been deploying custom malware—including Saltwater, SeaSpy, Sandbar, and SeaSide—since at least October 2022.
However, Barracuda refuted claims that the vulnerability was exploited as early as 2021, stating that the issue was addressed in 2023 via the BNSF-36456 patch.
U.S. cybersecurity agency CISA also reported that new malware strains, Submarine (aka DepthCharge) and Whirlpool, were used to backdoor Barracuda ESG appliances in cyberattacks on U.S. federal agencies.
Meanwhile, cybersecurity firm Mandiant attributed these global cyber intrusions to UNC4841, a Chinese state-sponsored hacking group.
Belgium’s History of Chinese Cyber Threats
This is not the first time Belgium has accused Chinese hackers of targeting its institutions. In July 2022, the Belgian Minister for Foreign Affairs alleged that Chinese threat groups, including APT27, APT30, APT31, and Gallium, had targeted Belgium’s defense and interior ministries.
The Chinese Embassy in Belgium denied the accusations, calling them “extremely unserious and irresponsible.”
Despite the serious implications of the recent VSSE breach, investigators have yet to find evidence of stolen data appearing on the dark web or any ransom demands. Belgian authorities continue to monitor cybercriminal forums for any signs of leaked intelligence.
The federal prosecutor’s office confirmed that a judicial investigation into the cyberattack began in November 2023 but emphasized that it remains too early to draw conclusions.
The VSSE has refrained from publicly commenting on the incident beyond confirming that a formal complaint has been filed.
With cyber espionage concerns rising across Europe, Belgium’s latest security breach underscores the growing vulnerabilities of intelligence agencies to sophisticated state-sponsored hacking campaigns.
As the investigation unfolds, Belgian authorities face mounting pressure to bolster cybersecurity defenses and prevent further infiltration of critical national security infrastructure.
This article was created using automation technology and was thoroughly edited and fact-checked by one of our editorial staff members
