Category Archives: China aggression

Two Tech Companies Report Chinese Malware in the Power Grids

Posted on by

No worries America, President Biden is on vacation again, this time for a week. Meanwhile, it was back in May that Microsoft and Mandiant (0wned by Google) reported Volt Typhoon was in a few power systems either for espionage or worse for later capability to disrupt. Presently, there is no immediate threat however, experts outside of the Federal government are studying the cyber language and issuing warnings.

Volt Typhoon's Cyberattack: Key Concerns and Implications for the Industry | TXOne Networks source

Experts say it’s one of the largest known cyber espionage campaigns against the US.

A key US military outpost, Guam’s ports and air bases would be crucial to any Western response to a conflict in Asia. Together with the Five Eyes alliance – comprising the intelligence agencies of the US, Australia, Britain, New Zealand and Canada – Microsoft published details of the malware.

A cyberattack on Guam is equivalent to an attack on Silicon Valley. Guam, with a population of nearly 154,000, is indistinguishable from the 50 states for the purposes of defense under international and domestic law. It would also be vital to US military operations in any conflict over Taiwan. The Guam Defense System, the defense architecture surrounding Guam and the Mariana Island Chain, is the top homeland defense priority of the current commander of the US Indo-Pacific Command, Admiral John Aquilino. Guam contains the United States’ largest refueling and armament stations in the first and second island chains that provide lines of defense against China. The 2023 National Defense Authorization Act also announced $1.4 billion for defense projects in Guam, and the U.S. Marine Corps is building its first new base in 72 years there. Guam has among the highest military recruitment levels in the United States. In recognition of Guam’s military importance, China calls its DF-26 intermediate ballistic missile, which has a 2500-mile firing range, “the Guam Killer.” Source

The U.S. has 3 military bases (installations in Guam)

Q&A: What does the US military do on the island of Guam? source

***

China’s “peacetime” targeting of critical infrastructure that is used by both civilians and the US military erodes the principles of the law of war. The principle of distinction ordinarily forbids targeting civilian objects, such as civilian property and infrastructure. However, many computer networks are used for both civilian and military purposes. Such “dual use” objects may be targetable based on their nature, purpose, and use. However, combatants must still comply with the other principles of the law of war: military necessity, proportionality, and avoiding unnecessary suffering.

Microsoft has tracked a group of what it believes to be Chinese state-sponsored hackers who have since 2021 carried out a broad hacking campaign that has targeted critical infrastructure systems in US states and Guam, including communications, manufacturing, utilities, construction, and transportation.

Microsoft’s blog post offered technical details of the hackers’ intrusions that may help network defenders spot and evict them: The group, for instance, uses hacked routers, firewalls, and other network “edge” devices as proxies to launch its hacking—targeting devices that include those sold by hardware makers ASUS, Cisco, D-Link, Netgear, and Zyxel. The group also often exploits the access provided from compromised accounts of legitimate users rather than its own malware to make its activity harder to detect by appearing to be benign.

Blending in with a target’s regular network traffic in an attempt to evade detection is a hallmark of Volt Typhoon and other Chinese actors’ approach in recent years, says Marc Burnard, a senior consultant of information security research at Secureworks. Like Microsoft and Mandiant, Secureworks has been tracking the group and observing its campaigns. He added that the group has demonstrated a “relentless focus on adaption” to pursue its espionage.

US government agencies, including the National Security Agency, the Cybersecurity and Infrastructure Security Agency (CISA), and the Justice Department published a joint advisory about Volt Typhoon’s activity today alongside Canadian, UK, and Australian intelligence. “Private sector partners have identified that this activity affects networks across US critical infrastructure sectors, and the authoring agencies believe the actor could apply the same techniques against these and other sectors worldwide,” the agencies wrote. As early as 2009, US intelligence officials warned that Chinese cyberspies had penetrated the US power grid to “map” the country’s infrastructure in preparation for a potential conflict. Two years ago, CISA and the FBI also issued an advisory that China had penetrated US oil and gas pipelines between 2011 and 2013. China’s Ministry of State Security hackers have gone much further in cyberattacks against the country’s Asian neighbors, actually crossing the line of carrying out data-destroying attacks disguised as ransomware, including against Taiwan’s state-owned oil firm CPC. Source

It was not until the New York Times reported this condition that anyone took it seriously. What is worse are the facts reported by CyberScoop in part:

The largely unknown amount of Chinese-made equipment within the North American grid is a threat to national security, experts warned during a Thursday congressional hearing that explored cybersecurity vulnerabilities within the electric sector.

Witnesses from the Department of Energy and private sector testifying during the Senate Energy and Natural Resources Committee echoed a sentiment increasingly heard in Washington that a longstanding dependence on Chinese technologies and cheap components is now an alarming national security issues for U.S. critical infrastructure.

 

 

 

CCP’s Little Red Classrooms Across America, Does Anyone Care?

Posted on by

Reposting in full from FNC:

Parents Defending Education (PDE), a grassroots organization dedicated to fighting indoctrination in the classroom, says it has uncovered disturbing evidence linking Chinese Communist Party (CCP)-sponsored financial entities to American K-12 schools.

The findings are detailed in a new report dubbed “Little Red Classrooms,” which was sent to 34 governors, key lawmakers and committee chairs on Wednesday.

“The alarming evidence uncovered by our investigation should concern parents, educators, and policymakers alike. Families deserve to know who is influencing the American education system so that they can make informed choices about what their children are learning behind closed doors,” PDE president Nicole Neily told Fox News Digital.

“The Trump administration took steps to rein in Confucius Institutes at colleges and universities. It is frightening, however, that no such transparency mandate exists at the K-12 level,” Neily continued. “Accordingly, it is imperative that elected officials at both the federal and state levels take immediate action to gauge the extent of these programs in order to ensure that American schoolchildren receive a high-quality education free from undue foreign interference.”

REP JIM BANKS DEMANDS ANSWERS ON ‘INADEQUATE’ DOD CONFUCIUS INSTITUTE WAIVER GUIDANCE: ‘AGENTS’ OF THE CCP

chinausflags

Parents Defending Education, a grassroots organization dedicated to fighting indoctrination in the classroom, says it has uncovered disturbing evidence linking Chinese Communist Party-sponsored financial entities to American K-12 schools. (Getty)

Parents Defending Education bills itself as “a national grassroots organization working to reclaim our schools from activists imposing harmful agendas. PDE’s sister organization, PDE Action, sent the “alarming” results of its lengthy “Little Red Classrooms” investigation to House Education & Workforce Committee Rep. Virginia Foxx, R-N.C.; House Armed Services Committee Chairman Rep. Mike Rogers, R-Ala.; and House Foreign Affairs Committee Chairman Rep. Mike McCaul, R-Texas.

According to the letters, which have been obtained by Fox News Digital, the investigation exposed how millions of dollars of China-linked funding has flowed into America’s K-12 classrooms. PDE believes American students are subject to CCP propaganda under the guise of Chinese language and culture programming.

“The fact the Chinese government had so much access to American classrooms, students, and curriculums should worry families,” PDE senior adviser Michele P. Exner wrote to McCaul.

The committee chairs were informed that through “records requests and publicly available information, it was discovered that 143 school districts across the United States have engaged in contracts to establish Confucius Institutes and Classrooms,” including in three of the nation’s top science and technology high schools, and several that are near 20 U.S. military bases.

“Considering China’s adversarial relationship with the United States, this poses significant security risks that warrant immediate attention from your committee,” Exner wrote to Foxx.

“The Chinese government has long touted their Confucius programming as a way to advance their strategic goals around the world. In 2009, former Chinese Communist Party Senior Chairman Li Changchun admitted that Confucius Institutes were an ‘important part of China’s overseas propaganda set-up’ and in 2017 Chinese government officials lauded the programs as a way to push China’s Belt and Road initiative,” the Foxx letter continued. “Security concerns with these China-led courses in America’s schools are well documented.”

BILL LIMITING CHINA-BACKED CONFUCIUS INSTITUTES PASSED UNANIMOUSLY BY SENATE

Rep. Michael McCaul (R-TX) arrives to a caucus meeting with House Republicans on Capitol Hill

House Foreign Affairs Committee Chairman Rep. Mike McCaul, R-Texas, was notified of Parents Defending Education’s findings. (Drew Angerer/Getty Images)

PDE also listed “examples of the alarming relationships China’s government has established with American K-12 classrooms,” such as the Simpson County Board of Education in Kentucky entering into an agreement with the North China Electric Power University to develop the Confucius Institute of Western Kentucky.

“The North China Electric Power University works directly with the Chinese government’s energy sector to push China’s global energy initiatives. The Chinese International Education Foundation (CIEF) tasked the university with selecting more than 34 Chinese teachers to send to Simpson County Public Schools for the 2020-2021 school year,” Exner wrote.

PDE also pointed to a pair of Chinese nationals who taught Mandarin at Appoquinimink School District in Delaware during the 2012-2013 school year. “According to a district webpage, these teachers underwent a ‘rigorous selection process’ in China. This includes interviews with Chinese government officials ‘at the national level,’” according to Exner, who also serves as PDE Action’s director of federal affairs.

The letter to McCaul noted that “34 states and the District of Columbia have had schools that have engaged in financial exchanges with the Chinese government or affiliated entities ranging from a few thousand dollars to more than a million dollars per contract,” according to PDE findings.

“Since 2009, the Chinese government has used Confucius Institutes and Confucius Classrooms to push their agenda in schools around the globe. Chinese Communist Party officials have openly stated how they are using these educational partnerships established under the guise of ‘cultural and language immersion programs’ to expand China’s overseas propaganda campaign,” Exner wrote.

“In a Chinese state media article from 2016, the Chinese Communist Party ‘lauded’ Confucius Institutes and Confucius Classrooms for promoting its Belt and Road Initiative. Security concerns with these China-linked programs became so problematic that the State Department declared them a ‘foreign mission’ during the summer of 2020,” Exner continued. “These programs have created significant security vulnerabilities for the United States and gave the CCP unfettered access to curriculums and America’s classrooms. PDE uncovered at least two connections between U.S. and China schools tied to the Chinese military and energy operations.”

UNIVERSITY TO CUT TIES WITH CHINESE CONFUCIUS INSTITUTE AFTER GOP SCRUTINY ON $17M DOD GRANT

PDE also accused the CCP of openly using deceptive tactics to influence the next generation of Americans to advance their own self-serving agenda.

“We cannot allow this to happen. We urge the committee to take immediate action to investigate, expose, and hold hearings on the Chinese government’s involvement in America’s schools. PDE looks forward to working with you in protecting our students from the threats of the CCP,” Exner wrote to McCaul.

PDE informed Rogers that Confucius Institutes and Classrooms were operating in schools in the vicinity of the following U.S. military bases including U.S. Naval Academy, Buckley Air Force Base and Space Force, Davis-Monthan Air Force Base, Dover Air Force Base, Fort Bliss, Fort Liberty, Fort Knox, Naval Station Great Lakes, Hanscom Air Force Base, Hill Air Force Base, Lackland Air Force Base, Langley Air Force Base, Los Angeles Air Force Base, MacDill Air Force Base, McGuire Air Force Base, U.S. Coast Guard Academy, Nellis Air Force Base, Naval Station Norfolk, Puget Sound Naval Shipyard and Naval Base San Diego.

“Allowing China to have unfettered access to America’s schools poses significant security risks to students and their families. It becomes even more dangerous when this is happening near sensitive locations containing information critical to our national security,” Exner wrote.

Democratic Arizona Gov. Katie Hobbs

PDE sent a letter to Arizona Gov. Katie Hobbs urging an investigation between Arizona’s public schools and Chinese government sponsored programs. (AP Photo/Ross D. Franklin, File)

WHAT CHINA IS DOING IN CUBA IS A BIG THREAT TO ALL OF US

PDE Action also wrote to several other influential lawmakers including Sen. Bernie Sanders, I-Vt.; and Sen. Bill Cassidy, R-La. The House China Select Committee, the Senate HELP Committee, the Senate Armed Services Committee and the Senate Foreign Relations Committee are expected to be notified of “Little Red Classrooms” findings, too.

PDE Action political director Alex Nester also sent a letter, which has been obtained by Fox News Digital, to Arizona Gov. Katie Hobbs.

“Documents uncovered via online searches and public records requests show that three schools in Arizona — Catalina Foothills School District and Tucson Unified School District, as well as the International School of Tucson — forged ties with Chinese government backed programs over the course of a decade,” Nester wrote.

“PDE Action respectfully requests the Office of the Governor of Arizona to investigate ties between Arizona’s public schools and Chinese government sponsored programs, such as Confucius Classrooms,” Nester continued. “While it’s vital for American students to have opportunities to learn world languages and cultures, public school districts should not give the Chinese government unfettered access to K-12 classrooms. This has the potential of posing significant security risks to students, families, and our national interests.”

A similar letter was sent to 33 additional governors on Wednesday morning, including Florida Gov. Ron DeSantis, California Gov. Gavin Newsom, Georgia Gov. Brian Kemp, New York Gov. Kathy Hochul, Oklahoma Gov. Kevin Stitt and Michigan Gov. Gretchen Whitmer.

PDE’s “Little Red Classrooms” report details more examples that the group finds deeply concerning, breaking down the $17,967,565 spent across 143 school districts in 34 states plus the District of Columbia.

Cuba Agrees to Host Chinese Spy Base

Posted on by

First there was a full-throated denial by Adm. Kirby from the White House Press Room that the story the Wall Street Journal reported was true. Then a couple of days later, Adm. Kirby walked it back and attempted in national security platitudes to explain why he initially denied the story. Then the White House decided to blame the Trump administration stating that China has had a base in Cuba since 2019. If that was true, then why would the Biden administration lift some sanctions on Cuba?

Well….no , under the Trump administration, that is not accurate either. Perhaps China only has had radar surveillance installation since 2018. but you can bet that since Russia has had a spy base in Cuba known as the Lourdes signals intelligence facility, they are not only collaborating but perhaps co-locating especially since Beijing and Moscow have nurtured a a friendly business relationship without limitations. However, no one is putting China and Cambodia in the conversation…that is right, China has a secret base there too, called the Ream Base. .Satellite imagery of Ream Naval Base from 5 February 2023, annotated to show the shape of the pier extension. Original image courtesy of BlackSky

 

Lourdes

Russia 'to reopen Lourdes spy base in Cuba' - BBC News 2014 source

Beyond the Wall Street Journal doing great work, then comes the Miami Herald with more.

The CIA and Office of the Director of National Intelligence declined to comment. The Cuban government also pushed back against the initial WSJ report calling it “totally false and unfounded information” in a statement made by the Vice-minister of Foreign Affairs, Carlos Fernández de Cossío.

Regardless of Cuba’s sovereign rights in defense matters, the official said, Cuba rejects “any foreign military presence in Latin America and the Caribbean, including that of numerous United States military bases and troops, especially the military base that illegally occupies a portion of the national territory in the province of Guantánamo.” While China might be already collecting intelligence on the U.S. from its commercial facilities in the region, having a signals-intelligence facility “adds to China’s capabilities, especially in times of war,” said Evan Ellis, professor at the U.S. Army War College Strategic Studies Institute, which monitors China’s relationship with Latin America and the Caribbean. “I think it telegraphs Chinese willingness in the current difficult environment between our two countries to take some of these bolder steps and their sense, with their growing military power and economic power and the perception of the U.S. democratic disarray, that they can take these steps that maybe a decade ago, they would not have risked,” Ellis said. “It’s not that big of a threshold that they’ve crossed, but it is significant,” he added.

The news follows intense speculation that Russia, not China, was planning to reopen its Soviet-era espionage base in Lourdes, a town near Havana, which it shut down in 2002. High-ranking Russian national security officials and diplomats have been traveling to the island recently and the two governments appear as close as ever, with Cuban leaders offering public support for Russia’s invasion of Ukraine. But when publicly asked about reopening the Lourdes base during his trip to Havana in April, Russian Foreign Minister Sergei Lavrov did not directly address the question. And despite several economic agreements recently announced by Russian and Cuban authorities, including land-lease deals, the news about a Chinese spy base speaks to the realities on the ground: The island is desperate for cash as its economy continues sinking. Russia had limited resources even before embarking on a war against Ukraine — and China can pay. On May 20, Cuba’s Interior Minister, Gen. Lázaro Alberto Álvarez Casas, met with China’s Minister of Public Security, Wang Xiaohong. “China stands ready to work with Cuba to implement the important consensus reached by the leaders of the two countries and deepen pragmatic cooperation in various fields, especially in law enforcement and security,” a Chinese government statement said.

The news about the spy base comes as the Biden administration has been taking steps to improve its strained relationship with China, which is considered the United States’ primary military and economic rival. At the same time, State Department officials and members of Congress have been raising concerns about China’s increased influence in Latin America and the Caribbean. China has become South America’s largest trading partner and has exploited the Biden administration’s reluctance to new trade deals and has inked a free trade agreement with Ecuador, while Uruguay and Panama are in line, U.S. Rep Maria Elvira Salazar, a Miami Republican, said during a congressional hearing she chaired on Wednesday. “That is very troublesome,” Salazar said, blaming the Biden administration for ignoring the pleas of allies in the region with conservative governments “to the benefit of our enemies.”

When asked by representative Warren Davidson, R-Ohio, why the United States has seemed to become “more passive” and allowed China to increase its influence in the Western Hemisphere, the State Department’s top diplomat for the region acknowledged the administration needs to act with a sense of urgency. “This is the most challenging moment I have seen in 30 years in our hemisphere, and we have to do everything that we can to help our neighbors and our partners around the region to succeed and resist these strategic competitors from outside,” Assistant Secretary for Western Hemisphere affairs Brian Nichols said. The China deal also complicates U.S. policy towards Cuba.

The administration has lifted some restrictions on flights and remittances, resumed the family reunification program for Cubans and reestablished migration and law enforcement talks with the Cuban government. But it stopped short of easing other embargo restrictions and removing Cuba from the list of countries that sponsor terrorism, which the Cuban government had made a condition to improving relations. The cozying up to Russia and China indicates the Cuban government has chosen to seek further support from its longtime political and ideological allies rather than pursuing normalization of relations with the U.S. at a time Cuban authorities perceive their grip on power is at risk. Cuba is facing its worst economic crisis in decades and serious political challenges from a population that has taken to the streets to protest and demand regime change. Ebrahim Raeisi, the president of Iran, another major U.S. adversary, is set to travel to the island after visiting Venezuela and Nicaragua next week. The strategy suggests something else: The Cuban military is calling the shots on the island, not the civilian team led by Cuba’s handpicked president, Miguel Díaz-Canel. If true, the deal with China shows “Cuba’s desperation. It’s the same thing with Russian investors. Cuba is looking for cash where it can get it,” Ellis said. “Cuba also understands the limits of the Biden administration.

With the Republicans in control of the House in Washington, with Biden being more conservative, with a sense of lessons learned that the Obama opening was seen as ‘we gave up too much and receive too little from Cuba,’ there’s an understanding in Cuba that they’re not going to get much more out of Washington.” Latin America’s sharp turn to the left and the consolidation of power by Nicolás Maduro in Venezuela also gives Cuba confidence to do bolder things, Ellis said, while noticing that island has not gone that far as to sign military agreements with Russia or receive Russian weapons. Florida Republicans in Congress quickly reacted to the report on the China espionage base deal to highlight what they said is an increasing national security threat coming from Cuba. “The threat to America from Cuba isn’t just real, it is far worse than this,” Sen. Marco Rubio tweeted. “But to date, not only does the Biden White House not care, they have people who actually want to appease the regime.” “The Cuban regime is auctioning off land to the Russians, hosting the Iranians, and letting the Chinese open a base to spy on the U.S.,” Salazar tweeted. “Just 90 miles from our coast, the dictatorship has opened the door to our greatest enemies!” Later on Thursday, Rubio, who is the Vice Chairman of the Select Committee on Intelligence and the committee’s chairman, Mark R. Warner (D-VA), issued a statement urging the Biden administration “to take steps to prevent this serious threat to our national security and sovereignty.” “We must be clear that it would be unacceptable for China to establish an intelligence facility within 100 miles of Florida and the United States, in an area also populated with key military installations and extensive maritime traffic,” they said.

Read more at: https://www.miamiherald.com/news/nation-world/world/americas/cuba/article276215936.html#storylink=cpy

 

The Mysterious Chinese Space Plane no One Talks About

Posted on by

Except for a congressman that sent me a text tied to this only this morning.China is paying Cuba to host a spy/eavesdropping facility in Cuba to monitor communications, phone calls and even satellite transmissions. How is that for a country that is just a competitor as Joe Biden tells us?

***

The second orbital mission of China’s robotic space plane has come to a close. It is called Known as Shenlong (“divine dragon”). It docked with or otherwise captured a separate object on multiple occasions, managed by China Aerospace Science and Technology Corporation.

The mysterious reusable vehicle touched down Monday (May 8) at the Jiuquan Satellite Launch Center in northwest China, wrapping up a 276-day mission to Earth orbit, according to China’s state-run Xinhua news agency.

“The success of the experiment marks an important breakthrough in China’s research on reusable spacecraft technologies, which will provide more convenient and affordable round-trip methods for the peaceful use of space in the future.”

The space plane launched from Jiuquan on Aug. 4, 2022, kicking off a mission short on details but long on intrigue.

On Oct. 31, for example, the vehicle ejected something into orbit. Some experts speculated that the object was a service module, possibly indicating that the space plane was getting ready to return to Earth.

Others posited that the new free flyer was a small satellite designed to monitor the Chinese space plane — perhaps the correct guess, given how much longer the robotic spacecraft stayed aloft.

 

***

Experts think the Chinese space plane is likely similar to the Boeing X-37B, a U.S. space plane that debuted in 2010. Kevin Pollpeter, a research scientist at the Center for Naval Analyses, told Nature.com that the reveal of X-37B sparked concern within the Chinese government over the craft’s military potential. It’s possible that this spurred the country’s space program, which is closely tied to its military, to start developing its own version, Pollpeter said.

Like the X-37B space plane, the Chinese craft appears to be uncrewed and relatively small. It probably first flew in September 2020, making a short two-day stint into orbit before returning to the ground. Its most recent mission began in August 2022, when it took off on a Long March 2F rocket from the Jiuquan Satellite Launch Center in northern China, according to a report from the Washington, D.C.-based Center for Strategic and International Studies (CSIS). The  exact purpose of the mission remains unclear.

According to the CSIS report, the craft released an “object” into orbit sometime in October. The object apparently disappeared in January, only to suddenly reappear on satellite tracking radar in March. Experts believe this could indicate that the plane has some sort of satellite removal capability, such as a robotic arm.

“[The Chinese] have been working a lot with robot arms in other contexts, like the Chinese space station,” Jonathan McDowell, an astrophysicist at the Harvard & Smithsonian Center for Astrophysics, told Nature.

If that’s the case, then the plane’s primary purpose might be to repair damaged satellites or remove orbital debris. However, this does not rule out military capabilities — either for the Chinese space plane or for the X-37B. Until more details come out, however, the best we can do is speculate. Source and more reading.

Image source

China Warning to America, Prepare to Live off the Land

Posted on by

It is a major cyber attack discovered by Microsoft. It was discovered while we were all watching that ‘silly spy balloon’ as Biden called it. The attack is called Volt Typhoon, so be on notice America. The Biden White House has said nothing….

Microsoft has uncovered stealthy and targeted malicious activity focused on post-compromise credential access and network system discovery aimed at critical infrastructure organizations in the United States. The attack is carried out by Volt Typhoon, a state-sponsored actor based in China that typically focuses on espionage and information gathering. Microsoft assesses with moderate confidence that this Volt Typhoon campaign is pursuing development of capabilities that could disrupt critical communications infrastructure between the United States and Asia region during future crises.

Volt Typhoon has been active since mid-2021 and has targeted critical infrastructure organizations in Guam and elsewhere in the United States. In this campaign, the affected organizations span the communications, manufacturing, utility, transportation, construction, maritime, government, information technology, and education sectors. Observed behavior suggests that the threat actor intends to perform espionage and maintain access without being detected for as long as possible.

To achieve their objective, the threat actor puts strong emphasis on stealth in this campaign, relying almost exclusively on living-off-the-land techniques and hands-on-keyboard activity. They issue commands via the command line to (1) collect data, including credentials from local and network systems, (2) put the data into an archive file to stage it for exfiltration, and then (3) use the stolen valid credentials to maintain persistence.

***

Dark Reading in part published the following:

China-sponsored threat actors have managed to establish persistent access within telecom networks and other critical infrastructure targets in the US, with the observed purpose of espionage — and, potentially, the ability down the line to disrupt communications in the event of military conflict in the South China Sea and broader Pacific.

The first signs of compromise emerged in telecom networks in Guam, according to a New York Times report ahead of the findings being released. The National Security Agency discovered those intrusions around the same time that the Chinese spy balloon was making headlines for entering US airspace, according to the report. It then enlisted Microsoft to further investigate, eventually uncovering a widespread web of compromises across multiple sectors, with a particular focus on air, communications, maritime, and land transportation targets.

A Shadow Goal? Laying Groundwork for Disruption

The discovery of the activity is playing out against the backdrop of the US’ frosty relations with Beijing; the two superpowers have stalled in their diplomacy since the shooting down of the balloon, and has worsened amidst fears that Russia’s invasion of Ukraine could spur China to do the same in Taiwan.

In the event of a military crisis, a destructive cyberattack on US critical infrastructure could disrupt communications and hamper the country’s ability to come to Taiwan’s aid, the Times report pointed out. Or, according to John Hultquist, chief analyst at Mandiant Intelligence – Google Cloud, a disruptive attack could be used as a proxy for kinetic action.

“These operations are aggressive and potentially dangerous, but they don’t necessarily indicate attacks are looming,” he said in an emailed statement. “A far more reliable indicator for [a] destructive and disruptive cyberattack is a deteriorating geopolitical situation. A destructive and disruptive cyberattack is not just a wartime scenario either. This capability may be used by states looking for alternatives to armed conflict.”

Andersen Air Force Base in Yigo, Guam Anderson Air Foce Base/source

Dubbing such preparations “contingency intrusions,” he added that China is certainly not alone in conducting them — although notably, China-backed APTs are typically far more focused on cyber espionage than destruction.

“Over the last decade, Russia has targeted a variety of critical infrastructure sectors in operations that we do not believe were designed for immediate effect,” Hultquist noted. “Chinese cyber threat actors are unique among their peers in that they have not regularly resorted to destructive and disruptive cyberattacks. As a result, their capability is quite opaque.”

An Observed Focus on Stealth & Spying

To achieve initial access, Volt Typhoon compromises Internet-facing Fortinet FortiGuard devices, a popular target for cyberattackers of all stripes (Microsoft is still examining how they’re being breached in this case). Once inside the box, the APT uses the device’s privileges to extract credentials from Active Directory account and authenticate to other devices on the network. Read more here.