Meanwhile, in the Pacific...
China-backed hackers ‘living off the land’ to target critical systems, says Five Eyes group
Targets include US military facilities on Guam that would be key in an Asia-Pacific conflict, say Microsoft and western spy agencies
A state-sponsored Chinese hacking group has been spying on a wide range of US critical infrastructure organisations and similar activities could be occurring globally, western intelligence agencies and
Microsoft have warned.
“The United States and international cybersecurity authorities are issuing this joint Cybersecurity Advisory (CSA) to highlight a recently discovered cluster of activity of interest associated with a People’s Republic of
China (PRC) state-sponsored cyber actor, also known as Volt Typhoon,” said a statement released by authorities in the US, Australia, Canada, New Zealand and the UK – countries that make up the Five Eyes intelligence network.
In a separate statement, Microsoft said Volt Typhoon had been active since mid-2021 and had targeted critical infrastructure in Guam, a crucial
US military outpost in the Pacific Ocean. “Mitigating this attack could be challenging,” Microsoft said.
While Chinese hackers are known to spy on western countries, this is one of the largest known cyber-espionage campaigns against American critical infrastructure.
“Microsoft assesses with moderate confidence that this Volt Typhoon campaign is pursuing development of capabilities that could disrupt critical communications infrastructure between the United States and Asia region during future crises,” the tech company said.
“In this campaign, the affected organisations span the communications, manufacturing, utility, transportation, construction, maritime, government, information technology, and education sectors.
“Observed behaviour suggests that the threat actor intends to perform espionage and maintain access without being detected for as long as possible.”
The US and western security agencies warned in their advisory that the activities involved “living off the land” tactics, which take advantage of built-in network tools to blend in with normal Windows systems.
It warned that the hacking could then incorporate legitimate system administration commands that appear “benign”.
The Chinese embassy in Washington did not immediately respond to a Reuters request for comment. However Beijing routinely denies carrying out state-sponsored cyber-attacks, and China in turn regularly accuses the US of cyber espionage.
Guam is home to US military facilities that would be key to responding to any conflict in the Asia-Pacific region.
Targets include US military facilities on Guam that would be key in an Asia-Pacific conflict, say Microsoft and western spy agencies
www.theguardian.com