AZ-800 health - Administering Windows Server Hybrid Core Infrastructure Updated: 2023

Copyright © 2023 IDG Communications, Inc.

May 24 (Reuters) - A state-sponsored Chinese hacking group has been spying on a wide range of U.S. critical infrastructure organizations, from telecommunications to transportation hubs, Western intelligence agencies and Microsoft (MSFT.O) said on Wednesday.

The espionage has also targeted the U.S. island territory of Guam, home to strategically important American military bases, Microsoft said in a report, adding that "mitigating this attack could be challenging."

While China and the United States routinely spy on each other, analysts say this is one of the largest known Chinese cyber-espionage campaigns against American critical infrastructure.

Chinese foreign ministry spokesperson Mao Ning said on Thursday the hacking allegations were a "collective disinformation campaign" from the Five Eyes countries, a reference to the intelligence sharing grouping of countries made up of the United States, Canada, New Zealand, Australia and the UK.

Mao said the campaign was launched by the U.S. for geopolitical reasons and that the report from Microsoft analysts showed that the U.S. government was expanding its channels of disinformation beyond government agencies.

"But no matter what varied methods are used, none of this can change the fact that the United States is the empire of hacking," she told a regular press briefing in Beijing.

It was not immediately clear how many organizations were affected, but the U.S. National Security Agency (NSA) said it was working with partners including Canada, New Zealand, Australia, and the UK, as well as the U.S. Federal Bureau of Investigation to identify breaches. Canada, UK, Australia and New Zealand warned they could be targeted by the hackers too.

Microsoft analysts said they had "moderate confidence" this Chinese group, which it dubbed as 'Volt Typhoon', was developing capabilities that could disrupt critical communications infrastructure between the United States and Asia region during future crises.

"It means they are preparing for that possibility," said John Hultquist, who heads threat analysis at Google's Mandiant Intelligence.

The Chinese activity is unique and worrying also because analysts don't yet have enough visibility on what this group might be capable of, he added.

"There is greater interest in this actor because of the geopolitical situation."

As China has stepped up military and diplomatic pressure in its claim to democratically governed Taiwan, U.S. President Joe Biden has said he would be willing to use force to defend Taiwan.

Security analysts expect Chinese hackers could target U.S. military networks and other critical infrastructure if China invades Taiwan.

The NSA and other Western cyber agencies urged companies that operate critical infrastructure to identify malicious activity using the technical guidance they issued.

"It is vital that operators of critical national infrastructure take action to prevent attackers hiding on their systems," Paul Chichester, director at the UK's National Cyber Security Centre said in a joint statement with the NSA.

Microsoft said the Chinese hacking group has been active since at least 2021 and has targeted several industries including communications, manufacturing, utility, transportation, construction, maritime, government, information technology, and education.

NSA cybersecurity director Rob Joyce said the Chinese campaign was using "built-in network tools to evade our defenses and leaving no trace behind." Such techniques are harder to detect as they use "capabilities already built into critical infrastructure environments," he added.

As opposed to using traditional hacking techniques, which often involve tricking a victim into downloading malicious files, Microsoft said this group infects a victim's existing systems to find information and extract data.

Guam is home to U.S. military facilities that would be key to responding to any conflict in the Asia-Pacific region. It is also a major communications hub connecting Asia and Australia to the United States by multiple submarine cables.

Bart Hoggeveen, a senior analyst at the Australian Strategic Policy Institute who specializes in state-sponsored cyber attacks in the region, said the submarine cables made Guam "a logical target for the Chinese government" to seek intelligence.

"There is high vulnerability when cables land on shore," he said.

New Zealand said it would work towards identifying any such malicious cyber activity in its country.

"It's important for the national security of our country that we're transparent and upfront with Australians about the threats that we face," Australia's Minister for Home Affairs and Cyber Security Clare O'Neil said.

Canada's cybersecurity agency said it had no reports of Canadian victims of this hacking as yet. "However, Western economies are deeply interconnected," it added. "Much of our infrastructure is closely integrated and an attack on one can impact the other."

Reporting by Chavi Mehta in Bengaluru; Editing by Anil D'Silva

Our Standards: The Thomson Reuters Trust Principles.

A state-sponsored Chinese hacking group has been spying on a wide range of US critical infrastructure organisations and similar activities could be occurring globally, western intelligence agencies and Microsoft have warned.

“The United States and international cybersecurity authorities are issuing this joint Cybersecurity Advisory (CSA) to highlight a recently discovered cluster of activity of interest associated with a People’s Republic of China (PRC) state-sponsored cyber actor, also known as Volt Typhoon,” said a statement released by authorities in the US, Australia, Canada, New Zealand and the UK – countries that make up the Five Eyes intelligence network.

In a separate statement, Microsoft said Volt Typhoon had been active since mid-2021 and had targeted critical infrastructure in Guam, a crucial US military outpost in the Pacific Ocean. “Mitigating this attack could be challenging,” Microsoft said.

While Chinese hackers are known to spy on western countries, this is one of the largest known cyber-espionage campaigns against American critical infrastructure.

“Microsoft assesses with moderate confidence that this Volt Typhoon campaign is pursuing development of capabilities that could disrupt critical communications infrastructure between the United States and Asia region during future crises,” the tech company said.

“In this campaign, the affected organisations span the communications, manufacturing, utility, transportation, construction, maritime, government, information technology, and education sectors.

“Observed behaviour suggests that the threat actor intends to perform espionage and maintain access without being detected for as long as possible.”

The US and western security agencies warned in their advisory that the activities involved “living off the land” tactics, which take advantage of built-in network tools to blend in with normal Windows systems.

It warned that the hacking could then incorporate legitimate system administration commands that appear “benign”.

The Chinese embassy in Washington did not immediately respond to a Reuters request for comment. However Beijing routinely denies carrying out state-sponsored cyber-attacks, and China in turn regularly accuses the US of cyber espionage.

Guam is home to US military facilities that would be key to responding to any conflict in the Asia-Pacific region.

Canada’s cybersecurity agency separately said it had had no reports of Canadian victims of the hacking as yet.

“However, western economies are deeply interconnected,” it added. “Much of our infrastructure is closely integrated and an attack on one can impact the other.”

The UK similarly warned the techniques used by the Chinese hackers on US networks could be applied worldwide.

Reuters and Agence France-Presse contributed to this report

Microsoft security researchers have unearthed a Chinese-sponsored hacking campaign targeting critical infrastructure in Guam and other unspecified locations within the United States, the tech giant warned on Wednesday. The hacking operation, code-named "Volt Typhoon,"  has been active since mid-2021 and "could disrupt critical communications infrastructure between the United States and Asia region during future crises."

Microsoft has not detected any offensive attacks, but noted Chinese intelligence and military hackers routinely prioritize espionage and the gathering of information, rather than destruction.

U.S. federal law enforcement and intelligence agencies including the FBI, NSA and Cybersecurity and Infrastructure Security Agency (CISA) released a bulletin Wednesday, outlining Volt Typhoon's ongoing operational playbook as well as a roadmap of code that enables possible victims to detect the intruder.  

According to the bulletin, authorities "recently discovered" the cluster of activity. "Private sector partners have identified that this activity affects networks across U.S. critical infrastructure sectors, and the authoring agencies believe the actor could apply the same techniques against these and other sectors worldwide," the brief continued.

China denied the latest hacking allegation on Thursday, calling it a disinformation campaign by the "Five Eyes" nations that share intelligence, according to the Reuters news agency. Those nations are the U.S., Canada, New Zealand, Australia and the UK. "Relevant reports from western agencies have no proof," Reuters quotes Chinese Foreign Ministry spokesperson Mao Ning as saying at a regular press briefing.

U.S. intelligence agencies first uncovered the malware in February, roughly the same time that the U.S. downed a Chinese spy balloon, the New York Times first reported. Activity by the Chinese-sponsored hacking group reportedly alarmed U.S. officials, given its proximity to Andersen Air Force Base. The naval port in Guam would play a critically important role in launching any U.S. military response in the event of a Taiwanese invasion.

"Attacks against our critical infrastructure in the event of a Chinese invasion of Taiwan is unfortunately not farfetched," CISA Director Jen Easterly warned in February. 

At the time, Easterly called the threat of cyber intrusions "far more dangerous" than the Chinese surveillance balloon.

"Our country is subject to cyber intrusions every day from the Chinese government, but these intrusions rarely make it into national news," Easterly said. "These intrusions can do real damage to our nation — leading to theft of our intellectual property and personal information; and even more nefariously, establishing a foothold for disrupting or destroying the cyber and physical infrastructure that Americans rely upon every hour of every day—for our power, our water, our transportation, our communication, our healthcare, and so much more. 

Once Volt Typhoon gains access into a network, it steals user credentials in order to gain access to other computer systems, according to Microsoft. "Observed behavior suggests that the threat actor intends to perform espionage and maintain access without being detected for as long as possible," Microsoft security researchers noted in Wednesday's blog. 

Microsoft cautioned that affected organizations spanned nearly every critical infrastructure sector, including "communications, manufacturing, utility, transportation, construction, maritime, government, information technology, and education sectors."

Microsoft urged those customers impacted to "close or change credentials for all compromised accounts."

As it did Thursday, China has consistently denied hacking into American networks, even after U.S. investigators accused the People's Republic of China of stealing the personal information of millions of current and former federal workers under the Obama administration.  

The Biden White House has hurriedly established cybersecurity standards for critical infrastructure after elevating ransomware attacks, such as the 2021 Russia-linked offensive on Colonial Pipeline, to an issue of national security.

Photography By Tyler Darden

A Chinese-sponsored hacking campaign targeting critical infrastructure in Guam and other locations within the United States is "of real concern," Microsoft president Brad Smith warned. 

Microsoft revealed the hacking operation, code-named "Volt Typhoon," on Wednesday, saying it could disrupt communications between the U.S. and Asia during a future potential conflict. The operation has been active for about two years. 

"What we found was what we think of as network intrusions, the prepositioning of code. It's something that we've seen in terms of activity before," Smith said in an interview with "Face the Nation." "This does represent the focus on critical infrastructure in particular, and that's obviously of real concern." 

Microsoft said Wednesday it had not detected any offensive attacks from the operation, but noted that Chinese intelligence and military hackers generally focus on espionage and the collection of information rather than destruction. 

Smith declined to give specifics on how the operation had come to light, and whether it was Microsoft that alerted U.S. spy agencies to the operation. 

"I don't want to go too deep into that," he said. "We certainly have found a good deal of this ourselves. I don't think we're the only ones that have been looking. We do share information, as you would expect. I don't know that we're the only ones who have found it either. 

"The good news is we have a pretty broad-based ability, not just as a company, but as an industry and a country to detect this kind of activity," he added. 

The New York Times reported that U.S. intelligence agencies uncovered the malware in February, around the same time the U.S. shot down a Chinese spy balloon. The malware appearing in telecommunications systems in Guam and elsewhere in the U.S. reportedly alarmed U.S. officials because of the critical role Guam would play in the U.S. military response to China's potential invasion of Taiwan. 

Smith said making the operation public is important to educating the affected sectors, and also to holding the perpetrators accountable. 

"I do think we live in a world where, frankly, there needs to be some level of accountability for anyone that is engaged in activity that forms this kind of threat or danger," Smith said. "And so there is a need for public transparency in that vein as well." 

China has denied the allegations. 

Nicole Sganga contributed reporting. 

Microsoft security researchers have unearthed a Chinese-sponsored hacking campaign targeting critical infrastructure in Guam and other unspecified locations within the United States, the tech giant warned on Wednesday. The hacking operation, code-named "Volt Typhoon,"  has been active since mid-2021 and "could disrupt critical communications infrastructure between the United States and Asia region during future crises."

Microsoft has not detected any offensive attacks, but noted Chinese intelligence and military hackers routinely prioritize espionage and the gathering of information, rather than destruction.

U.S. federal law enforcement and intelligence agencies including the FBI, NSA and Cybersecurity and Infrastructure Security Agency (CISA) released a bulletin Wednesday, outlining Volt Typhoon's ongoing operational playbook as well as a roadmap of code that enables possible victims to detect the intruder.

According to the bulletin, authorities "recently discovered" the cluster of activity. "Private sector partners have identified that this activity affects networks across U.S. critical infrastructure sectors, and the authoring agencies believe the actor could apply the same techniques against these and other sectors worldwide," the brief continued.

China denied the latest hacking allegation on Thursday, calling it a disinformation campaign by the "Five Eyes" nations that share intelligence, according to the Reuters news agency. Those nations are the U.S., Canada, New Zealand, Australia and the UK. "Relevant reports from western agencies have no proof," Reuters quotes Chinese Foreign Ministry spokesperson Mao Ning as saying at a regular press briefing.

U.S. intelligence agencies first uncovered the malware in February, roughly the same time that the U.S. downed a Chinese spy balloon, the New York Times first reported. Activity by the Chinese-sponsored hacking group reportedly alarmed U.S. officials, given its proximity to Andersen Air Force Base. The naval port in Guam would play a critically important role in launching any U.S. military response in the event of a Taiwanese invasion.

Story continues

"Attacks against our critical infrastructure in the event of a Chinese invasion of Taiwan is unfortunately not farfetched," CISA Director Jen Easterly warned in February.

At the time, Easterly called the threat of cyber intrusions "far more dangerous" than the Chinese surveillance balloon.

"Our country is subject to cyber intrusions every day from the Chinese government, but these intrusions rarely make it into national news," Easterly said. "These intrusions can do real damage to our nation — leading to theft of our intellectual property and personal information; and even more nefariously, establishing a foothold for disrupting or destroying the cyber and physical infrastructure that Americans rely upon every hour of every day—for our power, our water, our transportation, our communication, our healthcare, and so much more.

Once Volt Typhoon gains access into a network, it steals user credentials in order to gain access to other computer systems, according to Microsoft. "Observed behavior suggests that the threat actor intends to perform espionage and maintain access without being detected for as long as possible," Microsoft security researchers noted in Wednesday's blog.

Microsoft cautioned that affected organizations spanned nearly every critical infrastructure sector, including "communications, manufacturing, utility, transportation, construction, maritime, government, information technology, and education sectors."

Microsoft urged those customers impacted to "close or change credentials for all compromised accounts."

As it did Thursday, China has consistently denied hacking into American networks, even after U.S. investigators accused the People's Republic of China of stealing the personal information of millions of current and former federal workers under the Obama administration.

The Biden White House has hurriedly established cybersecurity standards for critical infrastructure after elevating ransomware attacks, such as the 2021 Russia-linked offensive on Colonial Pipeline, to an issue of national security.

Startup making caskets from mushrooms

Tina Turner's neighbors place flowers and candles outside her Switzerland home

Protests in Mississippi after police shoot and injure 11-year-old Aderrien Murry