Two Tech Companies Report Chinese Malware in the Power Grids

Posted on July 31, 2023July 31, 2023 by Denise Simon

No worries America, President Biden is on vacation again, this time for a week. Meanwhile, it was back in May that Microsoft and Mandiant (0wned by Google) reported Volt Typhoon was in a few power systems either for espionage or worse for later capability to disrupt. Presently, there is no immediate threat however, experts outside of the Federal government are studying the cyber language and issuing warnings.

Volt Typhoon's Cyberattack: Key Concerns and Implications for the Industry | TXOne Networks source

Experts say it’s one of the largest known cyber espionage campaigns against the US.

A key US military outpost, Guam’s ports and air bases would be crucial to any Western response to a conflict in Asia. Together with the Five Eyes alliance – comprising the intelligence agencies of the US, Australia, Britain, New Zealand and Canada – Microsoft published details of the malware.

A cyberattack on Guam is equivalent to an attack on Silicon Valley. Guam, with a population of nearly 154,000, is indistinguishable from the 50 states for the purposes of defense under international and domestic law. It would also be vital to US military operations in any conflict over Taiwan. The Guam Defense System, the defense architecture surrounding Guam and the Mariana Island Chain, is the top homeland defense priority of the current commander of the US Indo-Pacific Command, Admiral John Aquilino. Guam contains the United States’ largest refueling and armament stations in the first and second island chains that provide lines of defense against China. The 2023 National Defense Authorization Act also announced $1.4 billion for defense projects in Guam, and the U.S. Marine Corps is building its first new base in 72 years there. Guam has among the highest military recruitment levels in the United States. In recognition of Guam’s military importance, China calls its DF-26 intermediate ballistic missile, which has a 2500-mile firing range, “the Guam Killer.” Source

The U.S. has 3 military bases (installations in Guam)

source

***

China’s “peacetime” targeting of critical infrastructure that is used by both civilians and the US military erodes the principles of the law of war. The principle of distinction ordinarily forbids targeting civilian objects, such as civilian property and infrastructure. However, many computer networks are used for both civilian and military purposes. Such “dual use” objects may be targetable based on their nature, purpose, and use. However, combatants must still comply with the other principles of the law of war: military necessity, proportionality, and avoiding unnecessary suffering.

Microsoft has tracked a group of what it believes to be Chinese state-sponsored hackers who have since 2021 carried out a broad hacking campaign that has targeted critical infrastructure systems in US states and Guam, including communications, manufacturing, utilities, construction, and transportation.

Microsoft’s blog post offered technical details of the hackers’ intrusions that may help network defenders spot and evict them: The group, for instance, uses hacked routers, firewalls, and other network “edge” devices as proxies to launch its hacking—targeting devices that include those sold by hardware makers ASUS, Cisco, D-Link, Netgear, and Zyxel. The group also often exploits the access provided from compromised accounts of legitimate users rather than its own malware to make its activity harder to detect by appearing to be benign.

Blending in with a target’s regular network traffic in an attempt to evade detection is a hallmark of Volt Typhoon and other Chinese actors’ approach in recent years, says Marc Burnard, a senior consultant of information security research at Secureworks. Like Microsoft and Mandiant, Secureworks has been tracking the group and observing its campaigns. He added that the group has demonstrated a “relentless focus on adaption” to pursue its espionage.

US government agencies, including the National Security Agency, the Cybersecurity and Infrastructure Security Agency (CISA), and the Justice Department published a joint advisory about Volt Typhoon’s activity today alongside Canadian, UK, and Australian intelligence. “Private sector partners have identified that this activity affects networks across US critical infrastructure sectors, and the authoring agencies believe the actor could apply the same techniques against these and other sectors worldwide,” the agencies wrote. As early as 2009, US intelligence officials warned that Chinese cyberspies had penetrated the US power grid to “map” the country’s infrastructure in preparation for a potential conflict. Two years ago, CISA and the FBI also issued an advisory that China had penetrated US oil and gas pipelines between 2011 and 2013. China’s Ministry of State Security hackers have gone much further in cyberattacks against the country’s Asian neighbors, actually crossing the line of carrying out data-destroying attacks disguised as ransomware, including against Taiwan’s state-owned oil firm CPC. Source

It was not until the New York Times reported this condition that anyone took it seriously. What is worse are the facts reported by CyberScoop in part:

The largely unknown amount of Chinese-made equipment within the North American grid is a threat to national security, experts warned during a Thursday congressional hearing that explored cybersecurity vulnerabilities within the electric sector.

Witnesses from the Department of Energy and private sector testifying during the Senate Energy and Natural Resources Committee echoed a sentiment increasingly heard in Washington that a longstanding dependence on Chinese technologies and cheap components is now an alarming national security issues for U.S. critical infrastructure.

CCP’s Little Red Classrooms Across America, Does Anyone Care?

Posted on July 28, 2023July 28, 2023 by Denise Simon

Reposting in full from FNC:

Parents Defending Education (PDE), a grassroots organization dedicated to fighting indoctrination in the classroom, says it has uncovered disturbing evidence linking Chinese Communist Party (CCP)-sponsored financial entities to American K-12 schools.

The findings are detailed in a new report dubbed “Little Red Classrooms,” which was sent to 34 governors, key lawmakers and committee chairs on Wednesday.

“The alarming evidence uncovered by our investigation should concern parents, educators, and policymakers alike. Families deserve to know who is influencing the American education system so that they can make informed choices about what their children are learning behind closed doors,” PDE president Nicole Neily told Fox News Digital.

“The Trump administration took steps to rein in Confucius Institutes at colleges and universities. It is frightening, however, that no such transparency mandate exists at the K-12 level,” Neily continued. “Accordingly, it is imperative that elected officials at both the federal and state levels take immediate action to gauge the extent of these programs in order to ensure that American schoolchildren receive a high-quality education free from undue foreign interference.”

REP JIM BANKS DEMANDS ANSWERS ON ‘INADEQUATE’ DOD CONFUCIUS INSTITUTE WAIVER GUIDANCE: ‘AGENTS’ OF THE CCP

Parents Defending Education, a grassroots organization dedicated to fighting indoctrination in the classroom, says it has uncovered disturbing evidence linking Chinese Communist Party-sponsored financial entities to American K-12 schools. (Getty)

Parents Defending Education bills itself as “a national grassroots organization working to reclaim our schools from activists imposing harmful agendas. PDE’s sister organization, PDE Action, sent the “alarming” results of its lengthy “Little Red Classrooms” investigation to House Education & Workforce Committee Rep. Virginia Foxx, R-N.C.; House Armed Services Committee Chairman Rep. Mike Rogers, R-Ala.; and House Foreign Affairs Committee Chairman Rep. Mike McCaul, R-Texas.

According to the letters, which have been obtained by Fox News Digital, the investigation exposed how millions of dollars of China-linked funding has flowed into America’s K-12 classrooms. PDE believes American students are subject to CCP propaganda under the guise of Chinese language and culture programming.

“The fact the Chinese government had so much access to American classrooms, students, and curriculums should worry families,” PDE senior adviser Michele P. Exner wrote to McCaul.

The committee chairs were informed that through “records requests and publicly available information, it was discovered that 143 school districts across the United States have engaged in contracts to establish Confucius Institutes and Classrooms,” including in three of the nation’s top science and technology high schools, and several that are near 20 U.S. military bases.

“Considering China’s adversarial relationship with the United States, this poses significant security risks that warrant immediate attention from your committee,” Exner wrote to Foxx.

“The Chinese government has long touted their Confucius programming as a way to advance their strategic goals around the world. In 2009, former Chinese Communist Party Senior Chairman Li Changchun admitted that Confucius Institutes were an ‘important part of China’s overseas propaganda set-up’ and in 2017 Chinese government officials lauded the programs as a way to push China’s Belt and Road initiative,” the Foxx letter continued. “Security concerns with these China-led courses in America’s schools are well documented.”

BILL LIMITING CHINA-BACKED CONFUCIUS INSTITUTES PASSED UNANIMOUSLY BY SENATE

Rep. Michael McCaul (R-TX) arrives to a caucus meeting with House Republicans on Capitol Hill

House Foreign Affairs Committee Chairman Rep. Mike McCaul, R-Texas, was notified of Parents Defending Education’s findings. (Drew Angerer/Getty Images)

PDE also listed “examples of the alarming relationships China’s government has established with American K-12 classrooms,” such as the Simpson County Board of Education in Kentucky entering into an agreement with the North China Electric Power University to develop the Confucius Institute of Western Kentucky.

“The North China Electric Power University works directly with the Chinese government’s energy sector to push China’s global energy initiatives. The Chinese International Education Foundation (CIEF) tasked the university with selecting more than 34 Chinese teachers to send to Simpson County Public Schools for the 2020-2021 school year,” Exner wrote.

PDE also pointed to a pair of Chinese nationals who taught Mandarin at Appoquinimink School District in Delaware during the 2012-2013 school year. “According to a district webpage, these teachers underwent a ‘rigorous selection process’ in China. This includes interviews with Chinese government officials ‘at the national level,’” according to Exner, who also serves as PDE Action’s director of federal affairs.

The letter to McCaul noted that “34 states and the District of Columbia have had schools that have engaged in financial exchanges with the Chinese government or affiliated entities ranging from a few thousand dollars to more than a million dollars per contract,” according to PDE findings.

“Since 2009, the Chinese government has used Confucius Institutes and Confucius Classrooms to push their agenda in schools around the globe. Chinese Communist Party officials have openly stated how they are using these educational partnerships established under the guise of ‘cultural and language immersion programs’ to expand China’s overseas propaganda campaign,” Exner wrote.

“In a Chinese state media article from 2016, the Chinese Communist Party ‘lauded’ Confucius Institutes and Confucius Classrooms for promoting its Belt and Road Initiative. Security concerns with these China-linked programs became so problematic that the State Department declared them a ‘foreign mission’ during the summer of 2020,” Exner continued. “These programs have created significant security vulnerabilities for the United States and gave the CCP unfettered access to curriculums and America’s classrooms. PDE uncovered at least two connections between U.S. and China schools tied to the Chinese military and energy operations.”

UNIVERSITY TO CUT TIES WITH CHINESE CONFUCIUS INSTITUTE AFTER GOP SCRUTINY ON $17M DOD GRANT

PDE also accused the CCP of openly using deceptive tactics to influence the next generation of Americans to advance their own self-serving agenda.

“We cannot allow this to happen. We urge the committee to take immediate action to investigate, expose, and hold hearings on the Chinese government’s involvement in America’s schools. PDE looks forward to working with you in protecting our students from the threats of the CCP,” Exner wrote to McCaul.

PDE informed Rogers that Confucius Institutes and Classrooms were operating in schools in the vicinity of the following U.S. military bases including U.S. Naval Academy, Buckley Air Force Base and Space Force, Davis-Monthan Air Force Base, Dover Air Force Base, Fort Bliss, Fort Liberty, Fort Knox, Naval Station Great Lakes, Hanscom Air Force Base, Hill Air Force Base, Lackland Air Force Base, Langley Air Force Base, Los Angeles Air Force Base, MacDill Air Force Base, McGuire Air Force Base, U.S. Coast Guard Academy, Nellis Air Force Base, Naval Station Norfolk, Puget Sound Naval Shipyard and Naval Base San Diego.

“Allowing China to have unfettered access to America’s schools poses significant security risks to students and their families. It becomes even more dangerous when this is happening near sensitive locations containing information critical to our national security,” Exner wrote.

PDE sent a letter to Arizona Gov. Katie Hobbs urging an investigation between Arizona’s public schools and Chinese government sponsored programs. (AP Photo/Ross D. Franklin, File)

WHAT CHINA IS DOING IN CUBA IS A BIG THREAT TO ALL OF US

PDE Action also wrote to several other influential lawmakers including Sen. Bernie Sanders, I-Vt.; and Sen. Bill Cassidy, R-La. The House China Select Committee, the Senate HELP Committee, the Senate Armed Services Committee and the Senate Foreign Relations Committee are expected to be notified of “Little Red Classrooms” findings, too.

PDE Action political director Alex Nester also sent a letter, which has been obtained by Fox News Digital, to Arizona Gov. Katie Hobbs.

“Documents uncovered via online searches and public records requests show that three schools in Arizona — Catalina Foothills School District and Tucson Unified School District, as well as the International School of Tucson — forged ties with Chinese government backed programs over the course of a decade,” Nester wrote.

“PDE Action respectfully requests the Office of the Governor of Arizona to investigate ties between Arizona’s public schools and Chinese government sponsored programs, such as Confucius Classrooms,” Nester continued. “While it’s vital for American students to have opportunities to learn world languages and cultures, public school districts should not give the Chinese government unfettered access to K-12 classrooms. This has the potential of posing significant security risks to students, families, and our national interests.”

A similar letter was sent to 33 additional governors on Wednesday morning, including Florida Gov. Ron DeSantis, California Gov. Gavin Newsom, Georgia Gov. Brian Kemp, New York Gov. Kathy Hochul, Oklahoma Gov. Kevin Stitt and Michigan Gov. Gretchen Whitmer.

PDE’s “Little Red Classrooms” report details more examples that the group finds deeply concerning, breaking down the $17,967,565 spent across 143 school districts in 34 states plus the District of Columbia.

That Kabul Dissent Cable will be at the Center of Campaign Ads

Posted on June 7, 2023June 7, 2023 by Denise Simon

After months and months of the State Department blocking the release of the dissent cable, finally a few in the House got access. Getting access was so bad that legislation was about to be introduced to force the issue after several subpoenas.

People climb atop a plane click here for a photo gallery/credits courtesy of The Guardian

Rep. Darrell Issa, R-Calif., is slamming the Afghanistan dissent cable to which Secretary of State Antony Blinken allowed congressional access Tuesday as “embarrassing” and saying that it debunks the Biden administration’s narrative that it was caught off guard by the country’s swift collapse in 2021.

Issa, who serves on the House Foreign Affairs Committee, told Fox News Digital that he was the first committee member to view the dissent channel cable from the U.S. Embassy in Kabul and Washington’s response.

The State Department’s “dissent channel” allows for contrary views to be expressed by officials. The document, signed by 23 staffers and diplomats, warned about the possibility of a rapid Taliban advance as the U.S. left the country, which President Joe Biden and other top officials downplayed at the time.

“What we saw was their prediction, with great accuracy, of exactly what was going to happen and what the outcome would be if they did not change their directions,” the congressman said. “We saw a response from the office of the State Department saying, ‘We hear you, and we agree, basically, we don’t take it lightly.’ And then, obviously, we know what they did and didn’t do, which was totally insufficient for the warning that was given.”

“They redacted the specific names, but we now know that many of them were senior executive surrogates, meaning people that are paid at the highest level in the State Department,” he continued. “They knew and understood that there was no way that the Afghan military was going to defend successfully. They did not disagree with that, and as a result, they knew that Kabul would fall within weeks, that the Taliban would do what they have done, which is to continue to kill and persecute individuals, and they allowed it to happen.”

Issa said the cable also revealed that “there was no expectation by the State Department that there would be sustainability” in the region and knew that the billions of dollars of U.S. military equipment that was left behind was going to fall into the Taliban’s hands.

Issa said the cable went out on July 13, 2021, the response came back a week later on July 20, and Kabul officially fell weeks later on Aug. 15.

“Every prediction came through, including the quick collapse of the Afghan army,” he said.

Issa said his next course of action is trying to get the document declassified so that the families of the 13 U.S. service members who were killed during the chaotic withdrawal can get to the bottom of what happened.

“Redacting only a portion of a portion of a sentence takes this from a secret document to a confidential document, and confidential, quite frankly, in this case is even inappropriate,” he said.

“This is classified because it’s embarrassing,” he added. “There’s absolutely no reason the American people shouldn’t see it, and I will not rest until they do.”

“The bottom line is nothing ends here,” added Issa’s communications director, Jonathan Wilcox.

“This obliterates the administration’s big lie on Afghanistan – that this could not have been foretold, nobody could have seen this coming, nothing could have done to prevent it,” he said.

“We know it was received. We know it wasn’t followed,” he continued. “Their personnel on the ground saw this, reported it, warned them and were ignored.”

In a statement to Fox News Digital, the State Department accused Republicans of distorting the truth.

“We strongly disagree with the characterizations from some Members of Congress on the contents of the Afghanistan dissent cable,” a spokesperson said. “As Secretary Blinken previously stated in public testimony before Congress, the cable did not suggest the Afghan government and security forces were going to collapse prior to our departure. As the Secretary also said publicly, the Department agreed with the concerns raised in the cable, and in fact, a number of the recommendations the cable made were already in motion. The Secretary personally read and oversaw a response to the dissent cable, and its contents were factored into his thinking.”

“Taking the step of allowing Members of Congress to view the cable, despite the risk that it compromises the purpose of the Dissent Channel, was an extraordinary accommodation and it’s disappointing some Members are choosing to distort the content of the confidential cable,” the spokesperson added.

The State Department referred Fox News Digital to Blinken’s testimony in September 2021 referring to the cable. Continue to read here including the number of times that subpoenas were issued.

Does Iran Really Have a Hyper-sonic Missile System?

Posted on June 7, 2023June 7, 2023 by Denise Simon

Primer: Raytheon claims successful innovations for the defense of these missiles.

We’re using our decades of expertise to deliver digitally engineered, end-to-end offensive and defensive technologies to help keep the world safe. And the innovation never stops.

To accelerate hypersonic advances, we partner in creative ways that bring proven technology together with cutting-edge developments in heat management, propulsion and sensing. Teaming across the industry enables us to move advanced hypersonic capabilities out of laboratories, into test environments and into the hands of warfighters at top speed.

The question is what does Saudi Arabia or Israel have for offensive and defensive platforms? No ideas just yet.

only an artist rendering read more here

DUBAI, United Arab Emirates (AP) — Iran claimed on Tuesday that it had created a hypersonic missile capable of traveling at 15 times the speed of sound, adding a new weapon to its arsenal as tensions remain high with the United States over Tehran’s nuclear program.

The new missile — called Fattah, or “Conqueror” in Farsi — was unveiled even as Iran said it would reopen its diplomatic posts on Tuesday in Saudi Arabia after reaching a détente with Riyadh following years of conflict.

The tightly choreographed segment on Iranian state television apparently sought to show that Tehran’s hard-line government can still deploy arms against its enemies across much of the Middle East.

“Today we feel that the deterrent power has been formed,” Iranian President Ebrahim Raisi said at the event. “This power is an anchor of lasting security and peace for the regional countries.”

Gen. Amir Ali Hajizadeh, the head of the paramilitary Revolutionary Guard’s aerospace program, unveiled what appeared to be a model of the missile. Hajizadeh claimed the missile had a range of up to 1,400 kilometers (870 miles).

That’s about mid-range for Iran’s expansive ballistic missile arsenal, which the Guard has built up over the years as Western sanctions largely prevent it from accessing advanced weaponry.

“There exists no system that can rival or counter this missile,” Hajizadeh claimed.

That claim, however, depends on how maneuverable the missile is. Ballistic missiles fly on a trajectory in which anti-missile systems like the Patriot can anticipate their path and intercept them. Tuesday’s event showed what appeared to be a moveable nozzle for the Fattah, which could allow it to change trajectories in flight. The more irregular the missile’s flight path, the more difficult it becomes to intercept.

Iranian officials did not release footage of a Fattah successfully launching and then striking a target. Hajizadeh later said that there had been a ground test of the missile’s engine.

A ground test involves a rocket motor being put on a stand and fired to check its abilities while launching a missile with that rocket motor is much more complex.

Hypersonic weapons, which fly at speeds in excess of Mach 5, or five times the speed of sound, could pose crucial challenges to missile defense systems because of their speed and maneuverability. Iran described the Fattah as being able to reach Mach 15 — which is 15 times the speed of sound.

China is believed to be pursuing the weapons, as is America. Russia claims to already be fielding the weapons and has said it used them on the battlefield in Ukraine. However, speed and maneuverability isn’t a guarantee the missile will successfully strike a target. Ukraine’s air force in May said it shot down a Russian hypersonic Kinzhal missile with a Patriot battery.

Gulf Arab countries allied with the U.S. widely use the Patriot missile system in the region. Israel, Iran’s main rival in the Mideast, also has its own robust air defenses.

In November, Hajizadeh initially claimed that Iran had created a hypersonic missile, without offering evidence to support it. That claim came during the nationwide protests that followed the September death of 22-year-old Mahsa Amini after her arrest by the country’s morality police.

Tuesday’s announcement came as U.S. Secretary of State Antony Blinken is to begin a visit to Saudi Arabia.

___

China Warning to America, Prepare to Live off the Land

Posted on May 25, 2023May 25, 2023 by Denise Simon

It is a major cyber attack discovered by Microsoft. It was discovered while we were all watching that ‘silly spy balloon’ as Biden called it. The attack is called Volt Typhoon, so be on notice America. The Biden White House has said nothing….

Microsoft has uncovered stealthy and targeted malicious activity focused on post-compromise credential access and network system discovery aimed at critical infrastructure organizations in the United States. The attack is carried out by Volt Typhoon, a state-sponsored actor based in China that typically focuses on espionage and information gathering. Microsoft assesses with moderate confidence that this Volt Typhoon campaign is pursuing development of capabilities that could disrupt critical communications infrastructure between the United States and Asia region during future crises.

Volt Typhoon has been active since mid-2021 and has targeted critical infrastructure organizations in Guam and elsewhere in the United States. In this campaign, the affected organizations span the communications, manufacturing, utility, transportation, construction, maritime, government, information technology, and education sectors. Observed behavior suggests that the threat actor intends to perform espionage and maintain access without being detected for as long as possible.

To achieve their objective, the threat actor puts strong emphasis on stealth in this campaign, relying almost exclusively on living-off-the-land techniques and hands-on-keyboard activity. They issue commands via the command line to (1) collect data, including credentials from local and network systems, (2) put the data into an archive file to stage it for exfiltration, and then (3) use the stolen valid credentials to maintain persistence.

***

Dark Reading in part published the following:

China-sponsored threat actors have managed to establish persistent access within telecom networks and other critical infrastructure targets in the US, with the observed purpose of espionage — and, potentially, the ability down the line to disrupt communications in the event of military conflict in the South China Sea and broader Pacific.

The first signs of compromise emerged in telecom networks in Guam, according to a New York Times report ahead of the findings being released. The National Security Agency discovered those intrusions around the same time that the Chinese spy balloon was making headlines for entering US airspace, according to the report. It then enlisted Microsoft to further investigate, eventually uncovering a widespread web of compromises across multiple sectors, with a particular focus on air, communications, maritime, and land transportation targets.

A Shadow Goal? Laying Groundwork for Disruption

The discovery of the activity is playing out against the backdrop of the US’ frosty relations with Beijing; the two superpowers have stalled in their diplomacy since the shooting down of the balloon, and has worsened amidst fears that Russia’s invasion of Ukraine could spur China to do the same in Taiwan.

In the event of a military crisis, a destructive cyberattack on US critical infrastructure could disrupt communications and hamper the country’s ability to come to Taiwan’s aid, the Times report pointed out. Or, according to John Hultquist, chief analyst at Mandiant Intelligence – Google Cloud, a disruptive attack could be used as a proxy for kinetic action.

“These operations are aggressive and potentially dangerous, but they don’t necessarily indicate attacks are looming,” he said in an emailed statement. “A far more reliable indicator for [a] destructive and disruptive cyberattack is a deteriorating geopolitical situation. A destructive and disruptive cyberattack is not just a wartime scenario either. This capability may be used by states looking for alternatives to armed conflict.”

Anderson Air Foce Base/source

Dubbing such preparations “contingency intrusions,” he added that China is certainly not alone in conducting them — although notably, China-backed APTs are typically far more focused on cyber espionage than destruction.

“Over the last decade, Russia has targeted a variety of critical infrastructure sectors in operations that we do not believe were designed for immediate effect,” Hultquist noted. “Chinese cyber threat actors are unique among their peers in that they have not regularly resorted to destructive and disruptive cyberattacks. As a result, their capability is quite opaque.”

An Observed Focus on Stealth & Spying

To achieve initial access, Volt Typhoon compromises Internet-facing Fortinet FortiGuard devices, a popular target for cyberattackers of all stripes (Microsoft is still examining how they’re being breached in this case). Once inside the box, the APT uses the device’s privileges to extract credentials from Active Directory account and authenticate to other devices on the network. Read more here.