China Warning to America, Prepare to Live off the Land

It is a major cyber attack discovered by Microsoft. It was discovered while we were all watching that ‘silly spy balloon’ as Biden called it. The attack is called Volt Typhoon, so be on notice America. The Biden White House has said nothing….

Microsoft has uncovered stealthy and targeted malicious activity focused on post-compromise credential access and network system discovery aimed at critical infrastructure organizations in the United States. The attack is carried out by Volt Typhoon, a state-sponsored actor based in China that typically focuses on espionage and information gathering. Microsoft assesses with moderate confidence that this Volt Typhoon campaign is pursuing development of capabilities that could disrupt critical communications infrastructure between the United States and Asia region during future crises.

Volt Typhoon has been active since mid-2021 and has targeted critical infrastructure organizations in Guam and elsewhere in the United States. In this campaign, the affected organizations span the communications, manufacturing, utility, transportation, construction, maritime, government, information technology, and education sectors. Observed behavior suggests that the threat actor intends to perform espionage and maintain access without being detected for as long as possible.

To achieve their objective, the threat actor puts strong emphasis on stealth in this campaign, relying almost exclusively on living-off-the-land techniques and hands-on-keyboard activity. They issue commands via the command line to (1) collect data, including credentials from local and network systems, (2) put the data into an archive file to stage it for exfiltration, and then (3) use the stolen valid credentials to maintain persistence.

***

Dark Reading in part published the following:

China-sponsored threat actors have managed to establish persistent access within telecom networks and other critical infrastructure targets in the US, with the observed purpose of espionage — and, potentially, the ability down the line to disrupt communications in the event of military conflict in the South China Sea and broader Pacific.

The first signs of compromise emerged in telecom networks in Guam, according to a New York Times report ahead of the findings being released. The National Security Agency discovered those intrusions around the same time that the Chinese spy balloon was making headlines for entering US airspace, according to the report. It then enlisted Microsoft to further investigate, eventually uncovering a widespread web of compromises across multiple sectors, with a particular focus on air, communications, maritime, and land transportation targets.

A Shadow Goal? Laying Groundwork for Disruption

The discovery of the activity is playing out against the backdrop of the US’ frosty relations with Beijing; the two superpowers have stalled in their diplomacy since the shooting down of the balloon, and has worsened amidst fears that Russia’s invasion of Ukraine could spur China to do the same in Taiwan.

In the event of a military crisis, a destructive cyberattack on US critical infrastructure could disrupt communications and hamper the country’s ability to come to Taiwan’s aid, the Times report pointed out. Or, according to John Hultquist, chief analyst at Mandiant Intelligence – Google Cloud, a disruptive attack could be used as a proxy for kinetic action.

“These operations are aggressive and potentially dangerous, but they don’t necessarily indicate attacks are looming,” he said in an emailed statement. “A far more reliable indicator for [a] destructive and disruptive cyberattack is a deteriorating geopolitical situation. A destructive and disruptive cyberattack is not just a wartime scenario either. This capability may be used by states looking for alternatives to armed conflict.”

Andersen Air Force Base in Yigo, Guam Anderson Air Foce Base/source

Dubbing such preparations “contingency intrusions,” he added that China is certainly not alone in conducting them — although notably, China-backed APTs are typically far more focused on cyber espionage than destruction.

“Over the last decade, Russia has targeted a variety of critical infrastructure sectors in operations that we do not believe were designed for immediate effect,” Hultquist noted. “Chinese cyber threat actors are unique among their peers in that they have not regularly resorted to destructive and disruptive cyberattacks. As a result, their capability is quite opaque.”

An Observed Focus on Stealth & Spying

To achieve initial access, Volt Typhoon compromises Internet-facing Fortinet FortiGuard devices, a popular target for cyberattackers of all stripes (Microsoft is still examining how they’re being breached in this case). Once inside the box, the APT uses the device’s privileges to extract credentials from Active Directory account and authenticate to other devices on the network. Read more here. 

The Iran Nuclear Facility Deep Deep Underground

It has long been declared by the mullahs of Iran that their nuclear development operation was only for peaceful purposes. Well then why hide it? Associated Press did some good reporting that many other news outlets picked up. This should change the newly formed relationships now in the Middle East and those European leaders need a sobering and honest rethink of Iran.

DUBAI, United Arab Emirates (AP) — Near a peak of the Zagros Mountains in central Iran, workers are building a nuclear facility so deep in the earth that it is likely beyond the range of a last-ditch U.S. weapon designed to destroy such sites, according to experts and satellite imagery analyzed by The Associated Press.

The photos and videos from Planet Labs PBC show Iran has been digging tunnels in the mountain near the Natanz nuclear site, which has come under repeated sabotage attacks amid Tehran’s standoff with the West over its atomic program.

With Iran now producing uranium close to weapons-grade levels after the collapse of its nuclear deal with world powers, the installation complicates the West’s efforts to halt Tehran from potentially developing an atomic bomb as diplomacy over its nuclear program remains stalled.

Completion of such a facility “would be a nightmare scenario that risks igniting a new escalatory spiral,” warned Kelsey Davenport, the director of nonproliferation policy at the Washington-based Arms Control Association. “Given how close Iran is to a bomb, it has very little room to ratchet up its program without tripping U.S. and Israeli red lines. So at this point, any further escalation increases the risk of conflict.”

The construction at the Natanz site comes five years after then-President Donald Trump unilaterally withdrew America from the nuclear accord. Trump argued the deal did not address Tehran’s ballistic missile program, nor its support of militias across the wider Middle East.

But what it did do was strictly limit Iran’s enrichment of uranium to 3.67% purity, powerful enough only to power civilian power stations, and keep its stockpile to just some 300 kilograms (660 pounds).

Since the demise of the nuclear accord, Iran has said it is enriching uranium up to 60%, though inspectors recently discovered the country had produced uranium particles that were 83.7% pure. That is just a short step from reaching the 90% threshold of weapons-grade uranium.

As of February, international inspectors estimated Iran’s stockpile was over 10 times what it was under the Obama-era deal, with enough enriched uranium to allow Tehran to make “several” nuclear bombs, according to the head of the International Atomic Energy Agency.

President Joe Biden and Israel’s prime minister have said they won’t allow Iran to build a nuclear weapon. “We believe diplomacy is the best way to achieve that goal, but the president has also been clear that we have not removed any option from the table,” the White House said in a statement to the AP.

DUBAI, United Arab Emirates (AP) — Near a peak of the Zagros Mountains in central Iran, workers are building a nuclear facility so deep in the earth that it is likely beyond the range of a last-ditch U.S. weapon designed to destroy such sites, according to experts and satellite imagery analyzed by The Associated Press.

The photos and videos from Planet Labs PBC show Iran has been digging tunnels in the mountain near the Natanz nuclear site, which has come under repeated sabotage attacks amid Tehran’s standoff with the West over its atomic program.

With Iran now producing uranium close to weapons-grade levels after the collapse of its nuclear deal with world powers, the installation complicates the West’s efforts to halt Tehran from potentially developing an atomic bomb as diplomacy over its nuclear program remains stalled.

Completion of such a facility “would be a nightmare scenario that risks igniting a new escalatory spiral,” warned Kelsey Davenport, the director of nonproliferation policy at the Washington-based Arms Control Association. “Given how close Iran is to a bomb, it has very little room to ratchet up its program without tripping U.S. and Israeli red lines. So at this point, any further escalation increases the risk of conflict.”

The construction at the Natanz site comes five years after then-President Donald Trump unilaterally withdrew America from the nuclear accord. Trump argued the deal did not address Tehran’s ballistic missile program, nor its support of militias across the wider Middle East.

But what it did do was strictly limit Iran’s enrichment of uranium to 3.67% purity, powerful enough only to power civilian power stations, and keep its stockpile to just some 300 kilograms (660 pounds).

Since the demise of the nuclear accord, Iran has said it is enriching uranium up to 60%, though inspectors recently discovered the country had produced uranium particles that were 83.7% pure. That is just a short step from reaching the 90% threshold of weapons-grade uranium.

As of February, international inspectors estimated Iran’s stockpile was over 10 times what it was under the Obama-era deal, with enough enriched uranium to allow Tehran to make “several” nuclear bombs, according to the head of the International Atomic Energy Agency.

President Joe Biden and Israel’s prime minister have said they won’t allow Iran to build a nuclear weapon. “We believe diplomacy is the best way to achieve that goal, but the president has also been clear that we have not removed any option from the table,” the White House said in a statement to the AP.

The Islamic Republic denies it is seeking nuclear weapons, though officials in Tehran now openly discuss their ability to pursue one.

Iran’s mission to the United Nations, in response to questions from the AP regarding the construction, said that “Iran’s peaceful nuclear activities are transparent and under the International Atomic Energy Agency safeguards.” However, Iran has been limiting access for international inspectors for years.

Iran says the new construction will replace an above-ground centrifuge manufacturing center at Natanz struck by an explosion and fire in July 2020. Tehran blamed the incident on Israel, long suspected of running sabotage campaigns against its program.

Tehran has not acknowledged any other plans for the facility, though it would have to declare the site to the IAEA if they planned to introduce uranium into it. The Vienna-based IAEA did not respond to questions about the new underground facility.

The new project is being constructed next to Natanz, about 225 kilometers (140 miles) south of Tehran. Natanz has been a point of international concern since its existence became known two decades ago.

Protected by anti-aircraft batteries, fencing and Iran’s paramilitary Revolutionary Guard, the facility sprawls across 2.7 square kilometers (1 square mile) in the country’s arid Central Plateau.

usaf gbu57 bomb 3D Model in Projectiles 3DExport Details and source here

Bunker buster developed in the United States, which would take several to deal with this hidden nuclear facility.

Officials Confirm Chinese Balloon Collected Intelligence from Several Sensitive Sites

The administration came out with several lies abut the balloon and continued to claim it had limited value to the Chinese. Chairman of the Joint Chiefs additionally along with other military officials provided China with off-ramps stating the balloon had a glitch and went astray and further told the White House not to shoot it down due to the potential debris field. The Pentagon assessed that the balloon uncovering important information was not great. Even more terrifying is what China has planned with the intelligence gathered and what other rogue/enemy nations have access.

A balloon flies in the sky over Billings, Montana, US, February 1, 2023 in this picture obtained from social media. (Chase Doak/via Reuters)

Now, April 3, 2023, NBC has officially reported some truths.

The Chinese spy balloon that flew across the U.S. was able to gather intelligence from several sensitive American military sites, despite the Biden administration’s efforts to block it from doing so, according to two current senior U.S. officials and one former senior administration official.

China was able to control the balloon so it could make multiple passes over some of the sites (at times flying figure eight formations) and transmit the information it collected back to Beijing in real time, the three officials said. The intelligence China collected was mostly from electronic signals, which can be picked up from weapons systems or include communications from base personnel, rather than images, the officials said.

The three officials said China could have gathered much more intelligence from sensitive sites if not for the administration’s efforts to move around potential targets and obscure the balloon’s ability to pick up their electronic signals by stopping them from broadcasting or emitting signals.

The National Security Council referred NBC News to the Defense Department for comment. The Defense Department directed NBC News to comments from February in which senior officials said the balloon had “limited additive value” for intelligence collection by the Chinese government “over and above what [China] is likely able to collect through things like satellites in low earth orbit.”

China has said repeatedly that the balloon was an unmanned civilian airship that accidentally strayed off course, and that the U.S. overreacted by shooting it down. Officials have not said which company, department or organization the balloon belonged to, despite several requests for comment by NBC News.

After the balloon was shot down in February, Biden administration officials said it was capable of collecting signals intelligence.

The balloon had a self-destruct mechanism that could have been activated remotely by China, but the officials said it’s not clear if that didn’t happen because the mechanism malfunctioned or because China decided not to trigger it.

The balloon first entered U.S. airspace over Alaska on Jan. 28, according to the Biden administration, which said it was tracking it as it moved. Within the next four days, the balloon was flying over Montana — specifically Malmstrom Air Force Base, where the U.S. stores some of its nuclear assets.

The real damage assessment at this point cannot be measured but clearly China spied successfully and will heads roll? Nah…

Meet Zhe Wu and His Low Orbit Balloon Program

It went with almost zero attention that between our US Commerce Department added a handful of companies to a so-called Entity List last week, restricting them from obtaining US technologies in a move blasted by Beijing on Monday as “illegal unilateral sanctions”, almost as soon as the first balloon was shot out of the sky off the coast of South Carolina. Now, just exactly how did our officials know to do that so fast? Now we have to wonder why Treasury has not done the same.

At least someone was paying attention and knew of Zhe Wu and his work…yet no other part of any Federal agency or any part of the military was on their game for the last several years?

Okay…sounds about right.

Beijing Nanjiang Aerospace Technology

Established in 2015, Beijing Nanjiang is controlled by a subsidiary of Shanghai-listed real estate company Deluxe Family Co Ltd, which also invests in materials and robotics projects.

The state-run Science and Technology Daily in 2015 hailed the firm’s development of a large silver helium airship as the country’s first “new near-space platform with capabilities for both military and surveillance use”.

State media said the company’s steerable, reusable and continuously powered airship was equipped with broadband communications and “high-definition observation” gear.

China Electronics Technology Group Corporation 48th Research Institute

Part of a state-owned IT giant, the research institute specialises in building power systems and solar energy components, as well as semiconductor equipment.

The institute has worked to develop flexible solar power cells suitable for both military and civilian aircraft, the China National Space Administration said in a document in 2017.

Parent company China Electronics Technology Group Corporation also funds Hikvision, a surveillance camera maker that has been implicated in intensified monitoring of the Uyghur minority in Xinjiang.

Eagles Men Aviation Science and Technology Group Co

Founded by military aircraft expert Wu Zhe, the group specialises in research and development of stealth aircraft technologies.

Eagles Men is “devoted to becoming a benchmark business for China’s (strategy of) military-civil fusion”, according to the company’s profile page on the official Chinese Society of Aeronautics and Astronautics website.

The company in 2013 filed a patent for making airship skins stronger.

Wu told state media in 2019 that his team had developed a stratospheric airship able to “fly around the globe”.

Dongguan Lingkong Remote Sensing Technology Co

Set up in 2019, the company counts among its investors a branch of the state-run Beihang University, as well as Eagles Men Aviation.

Public records show Dongguan Lingkong has received licences from local market supervisors to conduct research on remote sensing technology, which allows aircraft to detect conditions on the ground from a high altitude.

Guangzhou Tian-Hai-Xiang Aviation Technology Co

The company was originally established by the Chinese military to develop “vehicle-mounted unmanned reconnaissance aircraft”, according to its official website.

Specialising in surveillance drones, the company was reorganised in 2006 with its current name and under the control of military veteran Li Yuzhuang.

Tian-Hai-Xiang says it has received multiple defence science awards, with its website boasting that the company was “the first unit in the domestic drone industry to equip our military’s first digitalised troops”.

Shanxi Eagles Men Aviation Science and Technology Group Co

A wholly owned subsidiary of Eagles Men Aviation, the company was set up in 2012 with a focus on chemical products, according to Chinese business database Tianyancha.

As report in part from The Wire:

On an October morning in 2007, Wu Zhe, an aircraft design expert at Beihang University, gave a lecture about the “military value of balloons.” He described why it was an area of key scientific research for China and explained different solutions for powering these unique aircraft. When he concluded, according to a university press release, his “erudite knowledge and brilliant speech” received multiple rounds of applause.

Nearly two decades later, Wu and his business partner, a tech investor and executive named Wang Dong, are at the center of a military-linked program that has sent balloons over the U.S. and other nations, setting off a diplomatic crisis in Washington. After days of intense media coverage, on February 4, the U.S. shot down one Chinese balloon off the coast of South Carolina, and has since shot down three more unidentified objects floating in American and Canadian airspace.

On Friday, the Commerce Department announced that they were leveling sanctions against six Chinese companies involved in the balloon program — which U.S. officials say aims to intercept communications and surveil the ground below, including sensitive military sites.

Records show that Wu and Wang are linked to four of the six sanctioned firms. The two men, according to data from WireScreen, have a complex network of companies involved in balloon and aerospace technologies, some of which are closely affiliated with the Chinese military but are not sanctioned by the U.S. government.

In a statement on Friday about the sanctions, Alan F. Estevez, the under secretary of commerce for industry and security, said that “today’s action makes clear that entities that seek to harm U.S. national security and sovereignty will be cut off from accessing U.S. technologies.” Neither of the two Chinese men, through their companies, responded to requests for comment.

Zhe Wu has published at least 23 scholarly papers of his work and they are found here..quite chilling actually. For instance: (note the date)

Hovering control for a stratospheric airship in unknown wind

A novel hovering control methodology for a stratospheric airship is presented by using path following approach in the presence of unknown wind by expressing the wind field in the state equation, which avoids the difficulty of guaranteeing system stability in strong wind for other stabilization methods.

In late 2022,
noted –>

Mystery airship spotted over Philippines near South China Sea

  • Images of an unidentified craft near Subic Bay have sparked speculation it could have been collecting military intelligence
  • There is no evidence the airship was from China, though its design appears similar to types on display at the Zhuhai air show

Images of the stratospheric airship – allegedly taken in Pangasinan province, about 100km (62 miles) from Subic Bay in the northern Philippine island of Luzon – were first posted on Facebook last weekend. The pictures were deleted, but not before they were also shared on Twitter.

There is no evidence that the airship was from China, although its design appears to be similar to several unmanned types developed by the state-owned Aviation Industry Corporation of China’s Special Aircraft Research Institute and other scientific academies.

Images of a stratospheric, long-endurance airship, said to have been taken near Subic Bay in the northern Philippines, were shared on social media. Photo: Facebook
The we hear that the objects in the airspace of North America were cylindrical.
Could it be? Below reported from Poland in reference to the same object.
Philippines. A stratospheric airship over the disputed South China Sea -  Polish News
I have asked several out there smarter than me about the connection of the objects with clustered ground hubs..or if ground hubs were dropped by the balloon or objects….I did not need an answer.. Seems there are several that have the answers and we are collaborating AGAIN with China?
An Observation Scheduling Approach Based on Task Clustering for High-Altitude Airship
by Jiawei  Chen, Oizhang Luo and Guohua Wu.

1
School of Computational Science and Engineering, Georgia Institute of Technology, Atlanta, GA 30332, USA
2
School of Traffic & Transportation Engineering, Central South University, Changsha 410075, China
3
Department of Electrical & Computer Engineering, National University of Singapore, Singapore 119260, Singapore
Sensors 22 02050 g001 550

You but the judge….

 

There is Never Going to be Adequate Consequences for Putin

The list is long…his war crimes in Syria…his approval for poisoning dissidents and the blasting of a passenger airliner out of the sky…those are just a few.

MH17 probe links Putin to missile that brought down plane


DW: Prosecutors in The Hague said Wednesday that Russian leader Vladimir Putin approved the transfer of missiles to Russian-backed rebel forces in eastern Ukraine who were later responsible for shooting down Malaysian Airlines flight MH17.

MH17 was struck down by a BUK missile over eastern Ukraine on July 17, 2014 as it flew from Amsterdam to Kuala Lumpur. All 298 people on board MH17 died.

The Missile Launcher that Shot Down MH17 - War on the Rocks source

Investigators in the Netherlands said there were “strong indications” based on intercepted phone calls that Putin had personally approved the weapons transfers to its proxy forces in the east of Ukraine.

Russia has long denied any involvement despite a mounting body of evidence to the contrary.

Despite the evidence, the probe is being halted as “all leads have been exhausted” and no further prosecutions could go forward.

The latest announcement comes weeks after a Dutch court convicted two Russians and a Ukrainian of mass murder for the loss of life aboard the flight.

What did investigators say?

In a statement, the Joint Investigation Team of six nations probing the incident said, “There are strong indications that the Russian president decided on supplying the Buk TELAR to the DPR (Donetsk People’s Republic) separatists.”

The Joint Investigation Team consists of investigators from the Netherlands, Australia, Belgium, Ukraine and Malaysia.

Investigators also said Russian officials were said to have delayed a decision on whether or not to send weapons to its proxy forces in the east of Ukraine while Putin was at a D-Day commemoration in France in June of 2014.

They played a recorded conversation of an aide who said, “There is only one who makes a decision,” later adding, “the person who is currently at a summit in France,” a reference to Putin.

As head of state, however, Putin enjoys immunity, investigators noted. They also hedged and suggested that “although we speak of strong indications, the high bar of complete and conclusive evidence is not reached.”

MH17 flight debris on fire in a field in Ukraine
Investigators said all investigatiive avenues in the deadly incident had been exhaustedImage: Dmitry Lovetsky/AP/dpa/picture alliance

Previously, investigators sought to name those responsible for firing the BUK missile that brought down MH17 and those whose responsibility extends to the chain of command. However, investigators conceded there were few avenues left to investigate the catastrophe.

In 2019, investigators released phone calls showing contact between Russian proxy forces occupying part of eastern Ukraine and a Kremlin aide at the time, Vladislav Surkov.

Dutch prosecutor Digna van Boetzelaer told a news conference, “The investigation has now reached its limit, all leads have now been exhausted, the investigation is therefore being suspended.”

The BUK missile that took out the Malaysian Airlines flight was brought from a Russian military base located in the city of Kursk.

Victims of MH17 came from 10 countries, with 196 Dutch, 43 Malaysians and 38 Australian residents on board at the time of the missile strike.

Australia vows to hold Russia accountable

Australia pledged to hold Russia accountable for shooting down Malaysia Airlines flight MH17, after a team of international investigators halted its probe into the disaster.

Australian Foreign Minister Penny Wong and Attorney-General Mark Dreyfus said Russia had repeatedly tried to thwart the investigation, making it “impossible” to collect proof.

However, they added that Australia would “hold Russia to account for its role in the downing of the civilian aircraft.”

ar/jcg (AFP, AP, dpa, Reuters)