Microsoft has issued a warning about state-backed Chinese hackers targeting critical infrastructure in the United States. The tech giant revealed that a group known as Volt Typhoon has been active since mid-2021 and has focused on organizations in various sectors, including communications, manufacturing, utilities, transportation, construction, maritime, information technology, and education.
The targets also include sites in Guam, a location where the US maintains a significant military presence. However, China has rejected these claims, accusing the US of being “the empire of hacking.”
Microsoft’s Findings
In a blog post on Wednesday, Microsoft stated that the hacking campaign conducted by Volt Typhoon seeks persistent access to the targeted systems. The company highlighted the potential threat of disrupting communications between the US and Asia during future crises. The group’s activities have raised concerns about the laying of technical groundwork for such disruptions, particularly targeting critical infrastructure.
Joint Advisory by Security Agencies
Alongside Microsoft’s warning, the National Security Agency, the FBI, the Cybersecurity and Infrastructure Security Agency (CISA), and their counterparts from Australia, New Zealand, Canada, and Britain, collectively known as the Five Eyes, released a joint advisory sharing technical details about the recent cluster of activities related to these state-sponsored hackers.
This move underscores the seriousness of the issue and the need for international collaboration in addressing cyber threats.
China’s Response
The Chinese government swiftly dismissed the allegations, stating that they lacked evidence. Chinese foreign ministry spokesperson Mao Ning accused the US of launching a collective disinformation campaign through the Five Eyes coalition for geopolitical reasons.
Despite the Chinese denial, the concerns raised by Microsoft and the joint advisory highlight the ongoing challenges and tensions in the realm of cybersecurity between the two nations.
Expert Analysis
Experts in the field of cybersecurity have noted the significance of Microsoft’s findings. John Hultquist, the chief analyst at Google’s Mandiant cybersecurity intelligence operation, emphasized the rarity of such probing from China, distinguishing it from the cyber activities of other nations like Russia, North Korea, and Iran. China has traditionally focused more on intelligence gathering rather than deploying disruptive malware in an armed conflict.
Mitigation Efforts and International Response
CISA Director Jen Easterly called for the mitigation of affected networks to prevent potential disruptions. The FBI’s Cyber Division Assistant Director, Bryan Vorndran, condemned the intrusion tactics used by the hackers. The ongoing tensions between the US and China, driven by various geopolitical factors, have escalated in recent months, contributing to the strained relationship between the two nations.
Conclusion
The warning from Microsoft regarding Chinese hackers targeting US critical infrastructure highlights the increasing cybersecurity threats faced by nations worldwide. With the potential for disruption of communications and the significance of critical infrastructure, it is crucial for countries to strengthen their cybersecurity measures and engage in international cooperation to mitigate such threats.
The ongoing tensions between the US and China further underscore the complexities involved in addressing cyber threats in the modern era.