Major Cyberattack in the United States: Chinese Hackers Infiltrate Critical Infrastructure!
On 25 May 2023, a massive cyberattack hit the United States, affecting "critical" infrastructure in various sectors, including government and communications organisations. The attack was attributed to a hacker group backed by the Chinese state, known as "Volt Typhoon".
Active since mid-2021, the Volt Typhoon group has infiltrated several vital US sectors. Microsoft warned on Wednesday that Chinese hackers had compromised "critical" cyber infrastructure across many sectors in the United States, with a particular focus on intelligence gathering. The sectors targeted include communications, industry, utilities, transport, construction, maritime, government, information technology and education.
According to Microsoft, the group's goal is to disrupt "critical communications infrastructure between the United States and the Asia region during future crises". The group appears to intend to carry out espionage operations and to maintain access to compromised systems for as long as possible without being detected.
The attack focuses in particular on communications infrastructure in Guam and other parts of the United States. This island, home to a major US military base in the Pacific Ocean, is of particular concern to US intelligence because it lies at the heart of any American military response to an invasion of Taiwan.
Volt Typhoon exploits an unnamed vulnerability in a popular cybersecurity suite called FortiGuard to infiltrate organisations. Once it has gained access to a corporate system, the hacker group steals user credentials from the security suite and uses them to try to access other corporate systems.
Western security agencies say the attacks use the so-called "Living off the land" (LotL) tactic, whereby the attacker uses the features and tools of the system they are targeting to break in without leaving a trace. Volt Typhoon tries to blend in with normal network activity by routing traffic through infected network devices in small businesses and at remote workers' homes, including routers, firewalls and virtual private networks (VPNs).
Jen Easterly, director of the US Cybersecurity and Infrastructure Security Agency, has also issued a warning about Volt Typhoon. She stressed that China has been running global operations for years to steal the intellectual property and sensitive data of critical infrastructure organisations. She added that the Volt Typhoon case "shows that China is using highly sophisticated means to target our country's critical infrastructure", and that its discovery "will enable network defenders to better understand how to detect and mitigate this malicious activity".
In the wake of these allegations, China did not react immediately. Beijing regularly denies carrying out or sponsoring cyberattacks, and in turn accuses the United States of cyber-espionage against it.
This cyberattack highlights the growing importance of cybersecurity in today's global context. States and organisations around the world must be vigilant and ready to respond to these threats to protect their critical infrastructure and sensitive information.
Our sources:
- CNBC: "Chinese state-sponsored hackers have compromised critical US cyber infrastructure, Microsoft warns", published on 25 May 2023.
- Lepetitjournal.com: "Cyberattaque massive aux États-Unis : un groupe de hackers chinois visé", published on 25 May 2023.