U.S. officials say critical systems have been infiltrated by Chinese hackers for years
Chinese hackers infiltrate U.S. systems overview:
- Who: U.S. and allied intelligence agencies issued a joint advisory that a Chinese-sponsored hacking group known as Volt Typhoon has compromised the systems of multiple critical infrastructure organizations within the United States.
- Why: Officials are concerned Volt Typhoon is attempting to pre-position itself so that it can disrupt system functions in the event of potential geopolitical tensions and/or military conflicts.
- Where: The joint advisory is relevant to consumers nationwide.
A Chinese-sponsored hacking group has compromised critical U.S. infrastructure, according to officials from American and allied intelligence agencies.
Hacking group Volt Typhoon has compromised some infrastructure organizations for at least five years, according to officials, who said the hackers have primarily been targeting the energy, water and wastewater systems, communications and transportation systems sectors. The officials did not name the compromised organizations.
The warning was made in a joint advisory co-authored by the Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA), Federal Bureau of Investigation (FBI) and officials in Australia, Canada, New Zealand and the United Kingdom.
Intelligence agency officials believe “with high confidence” that Volt Typhoon seeks to wreak havoc on critical infrastructure functions in the event of potential geopolitical tensions and/or military conflicts, according to the advisory.
“The U.S. authoring agencies assess with high confidence that Volt Typhoon actors are pre-positioning themselves on IT networks to enable lateral movement to OT assets to disrupt functions,” the joint advisory states.
Infrastructure outside the U.S. could be disrupted, as well
Canadian officials determined their country would likely be affected if Volt Typhoon were to disrupt U.S. infrastructure, due to cross-border integration. Officials in Australia and New Zealand said their critical infrastructure could also be vulnerable, according to the advisory.
The agencies are urging critical infrastructure agencies to take steps to mitigate the risks posed by the Chinese-sponsored hacking group and to “hunt for similar malicious activity.”
“Following the mitigations for prevention of or in response to an incident will help disrupt Volt Typhoon’s accesses and reduce the threat to critical infrastructure entities,” the advisory says.
The joint advisory comes more than six months after Microsoft warned in a May 2023 blog post that a Chinese hack had targeted United States infrastructure across a number of industries in an attempt to gather intelligence.
Are you concerned? Let us know in the comments.