The US government in recent months launched an operation to fight a pervasive Chinese hacking operation that successfully compromised thousands of internet-connected devices, according to two Western security officials and one person familiar with the matter.

The Justice Department and Federal Bureau of Investigation sought and received legal authorization to remotely disable aspects of the Chinese hacking campaign, the sources told Reuters.

The Biden administration has increasingly focussed on hacking, not only for fear nation states may try to disrupt the US election in November, but because ransomware wreaked havoc on Corporate America in 2023.

The hacking group at the centre of recent activity, Volt Typhoon, has especially alarmed intelligence officials who say it is part of a larger effort to compromise Western critical infrastructure, including naval ports, internet service providers and utilities.

While the Volt Typhoon campaign initially came to light in May 2023, the hackers expanded the scope of their operations late last year and changed some of their techniques, according to three people familiar with the matter.

The widespread nature of the hacks led to a series of meetings between the White House and private technology industry, including several telecommunications and cloud commuting companies, where the US government asked for assistance in tracking the activity.

Such breaches could enable China, national security experts said, to remotely disrupt important facilities in the Indo-Pacific region that in some form support or service US military operations. Sources said US officials are concerned the hackers were working to hurt US readiness in case of a Chinese invasion of Taiwan.

China, which claims democratically governed Taiwan as its own territory, has increased its military activities near the island in recent years in response to what Beijing calls "collusion" between Taiwan and the United States.

The Justice Department and FBI declined to comment. The Chinese embassy in Washington did not immediately respond to a request for comment.

When Western nations first warned about Volt Typhoon in May, Chinese foreign ministry spokesperson Mao Ning said the hacking allegations were a "collective disinformation campaign" from the Five Eyes countries, a reference to the intelligence sharing grouping of countries made up of the United States, Canada, New Zealand, Australia and the UK.

Volt Typhoon has functioned by taking control of swaths of vulnerable digital devices around the world - such as routers, modems, and even internet-connected security cameras - to hide later, downstream attacks into more sensitive targets, security researchers told Reuters. This constellation of remotely controlled systems, known as a botnet, are of primary concern to security officials because they limit the visibility of cyber defenders that monitor for foreign footprints in their computer networks.

"How it works is the Chinese are taking control of a camera or modem that is positioned geographically right next to a port or ISP (internet service provider) and then using that destination to route their intrusions into the real target," said a former official familiar with the matter. "To the IT team at the downstream target it just looks like a normal, native user that's sitting nearby."

The use of so-called botnets by both government and criminal hackers to launder their cyber operations is not new. The approach is often used when an attacker wants to quickly target numerous victims simultaneously or seeks to hide their origins.

The US government in recent months launched an operation to fight a pervasive Chinese hacking operation that successfully compromised thousands of internet-connected devices, according to two Western security officials and one person familiar with the matter.

The US government in recent months launched an operation to fight a pervasive Chinese hacking operation that successfully compromised thousands of internet-connected devices, according to two Western security officials and one person familiar with the matter. The Justice Department and Federal Bureau of Investigation sought and received legal authorization to remotely disable aspects of the Chinese hacking campaign, the sources told Reuters. The Biden administration has increasingly focussed on hacking, not only for fear nation states may try to disrupt the US election in November, but because ransomware wreaked havoc on Corporate America in 2023. The hacking group at the centre of recent activity, Volt Typhoon, has especially alarmed intelligence officials who say it is part of a larger effort to compromise Western critical infrastructure, including naval ports, internet service providers and utilities. While the Volt Typhoon campaign initially came to light in May 2023, the hackers expanded the scope of their operations late last year and changed some of their techniques, according to three people familiar with the matter. The widespread nature of the hacks led to a series of meetings between the White House and private technology industry, including several telecommunications and cloud commuting companies, where the US government asked for assistance in tracking the activity. Such breaches could enable China, national security experts said, to remotely disrupt important facilities in the Indo-Pacific region that in some form support or service US military operations. Sources said US officials are concerned the hackers were working to hurt US readiness in case of a Chinese invasion of Taiwan. China, which claims democratically governed Taiwan as its own territory, has increased its military activities near the island in recent years in response to what Beijing calls "collusion" between Taiwan and the United States. The Justice Department and FBI declined to comment. The Chinese embassy in Washington did not immediately respond to a request for comment. When Western nations first warned about Volt Typhoon in May, Chinese foreign ministry spokesperson Mao Ning said the hacking allegations were a "collective disinformation campaign" from the Five Eyes countries, a reference to the intelligence sharing grouping of countries made up of the United States, Canada, New Zealand, Australia and the UK. Volt Typhoon has functioned by taking control of swaths of vulnerable digital devices around the world - such as routers, modems, and even internet-connected security cameras - to hide later, downstream attacks into more sensitive targets, security researchers told Reuters. This constellation of remotely controlled systems, known as a botnet, are of primary concern to security officials because they limit the visibility of cyber defenders that monitor for foreign footprints in their computer networks. "How it works is the Chinese are taking control of a camera or modem that is positioned geographically right next to a port or ISP (internet service provider) and then using that destination to route their intrusions into the real target," said a former official familiar with the matter. "To the IT team at the downstream target it just looks like a normal, native user that's sitting nearby." The use of so-called botnets by both government and criminal hackers to launder their cyber operations is not new. The approach is often used when an attacker wants to quickly target numerous victims simultaneously or seeks to hide their origins.

US disabled Chinese hacking network targeting critical infrastructure, sources say

Microsoft has issued a warning stating that a state-sponsored Chinese cyberespionage group, Volt Typhoon, has been targeting critical infrastructure organisations across the United States, since at least mid-2021.&nbsp;

"Microsoft has uncovered stealthy and targeted malicious activity focused on post-compromise credential access and network system discovery aimed at critical infrastructure organizations in the United States," Microsoft said in a blog post.&nbsp;

Microsoft noted that it has been tracking the hacking group, which has been spying on multiple critical organisations, from telecommunications to transportation hubs, the Western intelligence agencies and Microsoft said on Wednesday.&nbsp;

Microsoft said in a report that the espionage has also targeted the US island territory of Guam, which is home to strategically important American military bases that would be key to responding to any conflict in the Asia-Pacific region.&nbsp;

In the blog post, it was added that the observed behaviour suggests that the "threat actor intends to perform espionage and maintain access without being detected for as long as possible".&nbsp;

Microsoft added that "mitigating this attack could be challenging".&nbsp;

As reported by news agency Reuters, the US National Security Agency (NSA) said it was working with partners including Canada, New Zealand, Australia, and the UK, as well as the US Federal Bureau of Investigation to identify breaches.&nbsp;

Meanwhile, it was not immediately clear how many organisations were affected.&nbsp;

While Chinese hackers are known to spy on Western countries, this is one of the largest known cyber espionage campaigns against American critical infrastructure.

This merges to be one of the most extensive cyber-espionage attacks against American critical infrastructure. Chinese hackers are known for spying on Western countries.&nbsp;

NSA Cybersecurity Director Rob Joyce said in a statement: "A PRC (People's Republic of China) state-sponsored actor is living off the land, using built-in network tools to evade our defences and leaving no trace behind."&nbsp;

He added that such "living off the land" spy techniques are harder to detect as they use "capabilities already built into critical infrastructure environments".&nbsp;

The post added, "Microsoft assesses with moderate confidence that this Volt Typhoon campaign is pursuing development of capabilities that could disrupt critical communications infrastructure between the United States and Asia region during future crises."&nbsp;

Reuters mentioned that Canada's cybersecurity agency separately said it had no reports of Canadian victims of this hacking as yet. "However, western economies are deeply interconnected, Much of our infrastructure is closely integrated and an attack on one can impact the other," it added.&nbsp;

(With inputs from agencies)&nbsp;&nbsp; 
 
&nbsp;

WATCH WION LIVE HERE

<iframe allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen="" frameborder="0" height="350" loading="”lazy”" src="https://www.wionews.com/live-tv/embed?autoplay=1&amp;mute=1" width="100%"></iframe>

You can now write for wionews.com and be a part of the community. Share your stories and opinions with us <a href="https://www.wionews.com/content-contribution-registration-form">here</a>.

Microsoft has issued a warning stating that a state-sponsored Chinese cyberespionage group, Volt Typhoon, has been targeting critical infrastructure organisations across the United States, since at least mid-2021.

Microsoft has issued a warning stating that a state-sponsored Chinese cyberespionage group, Volt Typhoon, has been targeting critical infrastructure organisations across the United States, since at least mid-2021. "Microsoft has uncovered stealthy and targeted malicious activity focused on post-compromise credential access and network system discovery aimed at critical infrastructure organizations in the United States," Microsoft said in a blog post. Microsoft noted that it has been tracking the hacking group, which has been spying on multiple critical organisations, from telecommunications to transportation hubs, the Western intelligence agencies and Microsoft said on Wednesday. Microsoft said in a report that the espionage has also targeted the US island territory of Guam, which is home to strategically important American military bases that would be key to responding to any conflict in the Asia-Pacific region. In the blog post, it was added that the observed behaviour suggests that the "threat actor intends to perform espionage and maintain access without being detected for as long as possible". Microsoft added that "mitigating this attack could be challenging". As reported by news agency Reuters, the US National Security Agency (NSA) said it was working with partners including Canada, New Zealand, Australia, and the UK, as well as the US Federal Bureau of Investigation to identify breaches. Meanwhile, it was not immediately clear how many organisations were affected. While Chinese hackers are known to spy on Western countries, this is one of the largest known cyber espionage campaigns against American critical infrastructure. This merges to be one of the most extensive cyber-espionage attacks against American critical infrastructure. Chinese hackers are known for spying on Western countries. NSA Cybersecurity Director Rob Joyce said in a statement: "A PRC (People's Republic of China) state-sponsored actor is living off the land, using built-in network tools to evade our defences and leaving no trace behind." He added that such "living off the land" spy techniques are harder to detect as they use "capabilities already built into critical infrastructure environments". The post added, "Microsoft assesses with moderate confidence that this Volt Typhoon campaign is pursuing development of capabilities that could disrupt critical communications infrastructure between the United States and Asia region during future crises." Reuters mentioned that Canada's cybersecurity agency separately said it had no reports of Canadian victims of this hacking as yet. "However, western economies are deeply interconnected, Much of our infrastructure is closely integrated and an attack on one can impact the other," it added. (With inputs from agencies) WATCH WION LIVE HERE You can now write for wionews.com and be a part of the community. Share your stories and opinions with us here.

Microsoft says Chinese hacking group Volt Typhoon spying on US critical infrastructure

volt-typhoon

Volt Typhoon, News on Volt Typhoon, stories on Volt Typhoon, articles on Volt Typhoon, Volt Typhoon stories at Wion, Volt Typhoon news, Volt Typhoon latest news

volt typhoon

US disabled Chinese hacking network targeting critical infrastructure, sources say

Microsoft says Chinese hacking group Volt Typhoon spying on US critical infrastructure