The infamous “Volt Typhoon” group has been hanging around in critical infrastructure for longer than previously documented, with CISA and the FBI warning that some companies have been compromised by the Chinese hackers for at least five years now.
The plan for Chinese hackers appears to be a focus on the critical infrastructure that supports military installations, but Wray warns that these groups are also likely to make more general attacks aimed at causing chaos in the lives of US civilians.
The FBI and DOJ are on the offensive against a Chinese hacking group thought to have infiltrated US critical infrastructure. Its activity highlights the need for vigilance in keeping an updated inventory of outdated and known vulnerable devices.
State-backed Chinese hackers targeting older Cisco routers at less well-defended international branches of US and Japanese corporations, By first downgrading to an older firmware, they can then install their own custom firmware with a stealthy backdoor for long-term exfiltration of information.
The Microsoft report reveals several security oversights that might have acted as chokepoints to stop the Chinese hackers from successfully using the signing key had they been functioning as intended.
Group of former US military officials have told Washington Post reporters that Chinese hackers deeply penetrated Japanese military networks in 2020 and appeared to dwell there for about a year. Military readiness and supply information was reportedly targeted.
New information indicates that damage from the breach by Chinese hackers was greater than initially thought. The cyber espionage campaign may have impacted hundreds of thousands of accounts in total, including Ambassador to China Nicholas Burns and assistant secretary of state for East Asia Daniel Kritenbrink.
Microsoft reports that Chinese hackers were able to gain access to select high-level US government email accounts via forged tokens. The breach window appears to have been from about mid-May to July 4. It was first detected in mid-June at the State Department.
Report finds that Chinese hackers have been roaming through the networks of private US critical infrastructure companies for years now, often keeping their presence a secret for extended periods via the use of “living off the land” techniques.
Media conglomerate News Corp has reported that a security breach first discovered in early 2022 stretches back to February 2020 and impacted a broad array of the company’s subsidiaries. Attackers believed to be a state-backed Chinese cyber espionage team.