Chinese Hackers Targeted US Infrastructure, Warn Five Eyes, Including Canada

Hands type on a keyboard in North Vancouver, B.C., on December, 19, 2012. The Canadian Press/Jonathan Hayward

State-sponsored hackers from China have been targeting U.S. critical infrastructure, cybersecurity officials from around the world, including Canada, warned Wednesday in a co-ordinated effort to root out the perpetrators.

The Canadian Centre for Cyber Security was just one of several international agencies, all of them part of the Five Eyes intelligence alliance, that took part in amplifying the alert issued by the U.S. National Security Agency.

The discovery of what the NSA described as “indicators of compromise” was first made by Microsoft and attributed to Volt Typhoon, a Chinese state actor that the company said has been active since mid-2021.

Volt Typhoon “typically focuses on espionage and information gathering,” the software giant warned in its own threat assessment.

“Microsoft assesses with moderate confidence that this Volt Typhoon campaign is pursuing development of capabilities that could disrupt critical communications infrastructure between the United States and Asia region during future crises.”

Rob Joyce, the director of cybersecurity for the NSA, described the style of attack as “living off the land” — using existing network tools and valid credentials to better avoid detection.

“A (People’s Republic of China) state-sponsored actor is living off the land, using built-in network tools to evade our defences and leaving no trace behind,” Joyce said in a statement.

“That makes it imperative for us to work together to find and remove the actor from our critical networks.”

The Microsoft report describes stealth as one of the interloper’s key goals in order to maintain access to the target network, which is why it relies on existing administrative tools and “hands-on-keyboard” activity to avoid detection.

“In addition, Volt Typhoon tries to blend into normal network activity by routing traffic through compromised small office and home office network equipment, including routers, firewalls and VPN hardware.”

Microsoft said Volt Typhoon has already targeted infrastructure facilities around the U.S., including in Guam, where the U.S. maintains an air force base and naval port, both of which are central elements of its military presence in the Pacific Ocean.

Pentagon officials also believe Guam and its military installations were among the principal targets of the Chinese spy balloon that was shot down in February after a week of drifting through North American airspace.

Canadian officials say there have been no reports of any systems inside Canada being targeted.

“The Canadian Centre for Cyber Security joins its international partners in sharing this newly identified threat and accompanying mitigation measures with critical infrastructure sectors,” agency head Sami Khoury said in a statement.

“The interconnected nature of our infrastructures and economies highlights the importance of working together with our allies to identify and share real-time threat information.”

Other agencies taking part in Wednesday’s announcement included the U.S. Cybersecurity and Infrastructure Security Agency, the FBI and cybersecurity agencies in Australia, New Zealand and the U.K.

“For years, China has conducted operations worldwide to steal intellectual property and sensitive data from critical infrastructure organizations around the globe,” said CISA director Jen Easterly.

“(Wednesday’s) advisory, put out in conjunction with our U.S. and international partners, reflects how China is using highly sophisticated means to target our nation’s critical infrastructure.”