View all newsletters
Receive our newsletter - data, insights and analysis delivered to you

Five Eyes nations warn that ‘Volt Typhoon’ Chinese hackers are targeting critical infrastructure

The hackers can move almost undetected through networks and could cause serious disruption.

By Claudia Glover

Malware that can move almost undetected through networks has been deployed by Chinese state-sponsored cybercriminals against critical infrastructure in the US, the Five Eyes security alliance has warned. The gang behind the breach, Volt Typhoon, is using what’s known as a “living off the land” attack to compromise businesses in sectors including telecoms and energy.

Volt Typhoon
The Volt Typhoon hacking gang is targeting critical infrastructure. (Photo by Zenobillis/Shutterstock)

A joint advisory from cybersecurity agencies in the Five Eyes nations – the US, UK, Australia, Canada and New Zealand – says Volt Typhoon is able to run undetected in crucial networks using built-in network administration tools to perform its objectives, a technique known as “living off the land”. It could target other nations as well as the US, the Five Eyes alliance believes.

Volt Typhoon found throughout US critical national infrastructure

Affected companies include organisations in the communications, manufacturing and IT sectors, as well as government agencies, though the advisory does not give any indication on the extent of the problem.

Volt Typhoon’s malware has also been found in critical infrastructure organisations in the US military outpost of Guam in the Pacific Ocean. Researchers at Microsoft have also been tracking the group’s activities, and say with “moderate confidence” that the campaign could disrupt critical communications infrastructure between the United States and Asia in the event of a future crisis.

The Chinese government has hit back at the allegations. Chinese foreign ministry spokesperson Mao Ning said earlier today that the cyber espionage allegations were a “collective disinformation campaign” from the Five Eyes countries. She added that the involvement of Microsoft shows the US is expanding into channels of disinformation beyond government agencies. “But no matter what varied methods are used, none of this can change the fact that the United States is the empire of hacking,” Ning said at a press briefing in Beijing

How Chinese cybercriminals are accessing US networks

Microsoft believes Volt Typhoon accesses systems through devices running Fortinet’s FortiGuard security software, explains Microsoft. “The threat actor attempts to leverage any privileges afforded by the Fortinet device, extracts credentials to an Active Directory account used by the device, and then attempts to authenticate to other devices on the network with those credentials,” it said in a blog post.

Compromised small and home office network devices belonging to staff working remotely were used as intermediate infrastructure to obscure criminal activity, the report reveals. These would be deployed as emulators to make it seem like network activity was coming from an internet provider in the geographic area of the victim, rather than from the hackers.

Content from our partners
Rethinking cloud: challenging assumptions, learning lessons
DTX Manchester welcomes leading tech talent from across the region and beyond
The hidden complexities of deploying AI in your business

To mitigate these attacks, defenders should harden domain controllers and monitor event logs. Any use of administrator privilege should be audited and validated to confirm the legitimacy of executed commands. Defenders should also investigate unusual IP addresses and ports in command lines, registry entries and firewall logs to identify other hosts that are potentially involved in actor actions, the agencies recommend.

Paul Chichester, NCSC director of operations said it is “vital that operators of critical national infrastructure take action to prevent attackers hiding on their systems, as described in this joint advisory with our international partners.” He added: “We strongly encourage UK essential service providers to follow our guidance to help detect this malicious activity and prevent persistent compromise.”

Read more: ABB suffers Black Basta cyberattack

Topics in this article :
Websites in our network
Select and enter your corporate email address Tech Monitor's research, insight and analysis examines the frontiers of digital transformation to help tech leaders navigate the future. Our Changelog newsletter delivers our best work to your inbox every week.
  • CIO
  • CTO
  • CISO
  • CSO
  • CFO
  • CDO
  • CEO
  • Architect Founder
  • MD
  • Director
  • Manager
  • Other
Visit our privacy policy for more information about our services, how Progressive Media Investments may use, process and share your personal data, including information on your rights in respect of your personal data and how you can unsubscribe from future marketing communications. Our services are intended for corporate subscribers and you warrant that the email address submitted is your corporate email address.