Article Details

US says China's Volt Typhoon is readying destructive cyberattacks. 12 international govt agencies sound the alarm, critical infrastructure at the heart of threats. The US government today confirmed that China's Volt Typhoon crew comprised "multiple" critical infrastructure org's IT networks, and warned that the state-sponored hackers are readying "disruptive or destructive cyberattacks" against these targets. The group compromised IT environments — primarily across communications, energy, transportation systems, and water and wastewater system sectors — in the continental and non-continental United States and its territories, including Guam. "Volt Typhoon's choice of targets and pattern of behavior is not consistent with traditional cyber espionage or intelligence gathering operations, and the US authoring agencies assess with high confidence that Volt Typhoon actors are pre-positioning themselves on IT networks to enable lateral movement to OT assets to disrupt functions," the 12 government agencies warned.  The authoring agencies are: the US Cybersecurity and Infrastructure Security Agency (CISA), US National Security Agency (NSA), US Federal Bureau of Investigation (FBI), US Department of Energy (DOE), US Environmental Protection Agency (EPA), US Transportation Security Administration (TSA), Australian Signals Directorate's (ASD's) Australian Cyber Security Centre (ACSC), Canadian Centre for Cyber Security (CCCS), a part of the Communications Security Establishment (CSE), United Kingdom National Cyber Security Centre (NCSC-UK), and New Zealand National Cyber Security Centre (NCSC-NZ). According to the US agencies, Volt Typhoon will likely use this network access for disruptive attacks in the event of geopolitical tensions or military conflicts. This follow's last week's similar warning from FBI Director Christopher Wray that Chinese attackers are preparing to "wreak havoc" on American infrastructure, and the Justice Department's disclosure that Volt Typhoon infected "hundreds" of outdated Cisco and Netgear equipment with malware in an attempt to break into US critical infrastructure facilities. While the threat to American critical infrastructure appears to be the highest, should US facilities be disrupted, "Canada would likely be affected as well, due to cross-border integration," according to CCCS.  Australian and New Zealand critical infrastructure could be vulnerable as well. In addition to sounding the alarm, the governments issued a long list of technical details, TTPs observed in the digital break-ins, and detection recommendations and best practices.  Plus, there's three actions that owners and operators should take "today" to mitigate the threat. These include: apply patches for internet-facing systems with priority given to appliances that Volt Typhoon likes to exploit.  Second: turn on phishing-resistant multi-factor authentication (MFA). And finally, ensure that logging is turned on for applications, access and security logs, and store these logs in a centralized system.