Beijing Slams Five Eyes For Cyberattack Allegations

The report of the Joint Cybersecurity Advisory was published after FBI Director Christopher Wray warned on January 31 that China's hackers are targeting American infrastructure in preparation to wreak havoc and cause real-world harm to US citizens and communities.

He said China's hackers are targeting water treatment plants, electrical grids, oil and natural pipelines and transportation systems in the US.

Wang said on February 1 that Wray's criticism is“extremely irresponsible and is a complete distortion of facts.” He said the US itself is the origin and the biggest perpetrator of cyberattacks as the US Cyber Force Command openly declared that the critical infrastructure of other countries is a legitimate target for US cyberattacks.

In its latest report, the CISA, NSA and FBI warned that Volt Typhoon has been targeting some key infrastructure in the US and allies, including:

• US Department of Energy (DOE)
• US Environmental Protection Agency (EPA)
• US Transportation Security Administration (TSA)
• Australian Signals Directorate's Australian Cyber Security Center (ACSC)
• Canadian Center for Cyber Security (CCCS), a part of the Communications Security Establishment (CSE)
• United Kingdom National Cyber Security Center (NCSC-UK)
• New Zealand National Cyber Security Center (NCSC-NZ)

They said Volt Typhoon actors conduct extensive pre-exploitation reconnaissance to learn about a target organization and its environment; tailor their tactics, techniques, and procedures (TTPs) to the victim's environment; and dedicate ongoing resources to maintaining persistence and understanding the target environment over time, even after initial compromise.

“The US authoring agencies have recently observed indications of Volt Typhoon actors maintaining access and footholds within some victim IT environments for at least five years,” they added.

They said Volt Typhoon is also known as Vanguard Panda, Bronze Silhouette, Voltzite and Insidious Taurus.

On January 29, Reuters reported that the US government in recent months launched an operation to crack down on Volt Typhoon. It said the US Justice Department and FBI have sought and received legal authorization to remotely disable aspects of the group's hacking campaign.

Citing three unnamed sources, it said Volt Typhoon expanded the scope of its operations in late 2023 and changed some of its technologies, resulting in a series of meetings between the White House and private businesses in the technology industry.

On May 24 last year, Microsoft said it has uncovered stealthy and targeted malicious activity focused on post-compromise credential access and network system discovery aimed at critical infrastructure organizations in the US.

It said Volt Typhoon has been active since mid-2021 and has targeted critical infrastructure organizations in Guam and elsewhere in the US.

It said the hacker group collected data, including credentials from local and network systems, put the data into an archive file to stage it for exfiltration and then used some stolen valid credentials to maintain persistence.

A Zhejiang-based military writer called Zhiye published an article with the title“Chinese hackers Volt Typhoon have made achievements again, leaving the Central Intelligence Agency (CIA) and Microsoft bewildered.”

Sign up for one of our free newsletters

• The Daily Report Start your day right with Asia Times' top stories
• AT Weekly Report A weekly roundup of Asia Times' most-read stories

In a joint statement released last May, the cybersecurity departments of the Five Eyes governments disclosed the methods that were used by Volt Typhoon to hack foreign organizations and remove its traces.

CrowdStrike, a Texas-based cybersecurity firm, said last June that its team successfully identified Vanguard Panda's webshells, or malicious scripts, as the Chinese hacker group made a misstep when wiping out its traces.

The company said Vanguard Panda had clearly performed extensive preparation, including prior reconnaissance and enumeration, with its knowledge and use of remote hosts within the environment.

Since 1999, China's hackers have launched many rounds of cyberattacks on government-related websites in the US. In an attack in 2001, the White House's website was down for more than two hours due to Chinese hackers' attack.

Read: US calls Chinese EVs a posssible security threat

Follow Jeff Pao on Twitter at
@jeffpao3

Already have an account? Sign i Sign up here to comment on Asia Times stories OR

Thank you for registering!

An account was already registered with this email. Please check your inbox for an authentication link.