Around the time that the US Federal Bureau of Investigation (FBI) was examining the equipment recovered from the wreckage of the Chinese spy balloon shot down off the South Carolina coast in February, American intelligence agencies and Microsoft detected what they feared was a more worrisome intruder: mysterious computer code that has been popping up in telecommunications systems in Guam and elsewhere in the US.
The code, which Microsoft said was installed by a Chinese government hacking group, raised alarms because Guam, with its Pacific ports and vast American air base, would be a centerpiece of any American military response to an invasion or blockade of Taiwan. It was installed with great stealth, sometimes flowing through routers and other common internet-connected consumer devices, to make the intrusion harder to track. But unlike the balloon that fascinated Americans as it performed pirouettes over sensitive nuclear sites, the computer code could not be shot down on live television. So instead, Microsoft and the National Security Agency (NSA) were set on 24 May to publish details of the code that would make it possible for corporate users, manufacturers and others to detect and remove it.[1]
The code is called a “web shell,” in this case a malicious script that enables remote access to a server. Home routers are particularly vulnerable, especially older models that have not had updated software and protections.
Microsoft called the hacking group “Volt Typhoon” and said that it was part of a state-sponsored Chinese effort aimed at not only critical infrastructure such as communications, electric and gas utilities, but also maritime operations and transportation. The intrusions appeared, for now, to be an espionage campaign. But the Chinese could use the code, which is designed to pierce firewalls, to enable destructive attacks, if they choose. So far, Microsoft says, there is no evidence that the Chinese group has used the access for any offensive attacks. Unlike Russian groups, the Chinese intelligence and military hackers usually prioritize espionage.
In interviews, US administration officials said they believed the code was part of a vast Chinese intelligence collection effort that spans cyberspace, outer space and, as Americans discovered with the balloon incident, the lower atmosphere.
The current federal administration has declined to discuss what the FBI found as it examined the equipment recovered from the balloon. But the craft, better described as a huge aerial vehicle, apparently included specialized radars and communications interception devices that the FBI has been examining since the balloon was shot down. It is unclear whether the government’s silence about its finding from the balloon is motivated by a desire to keep the Chinese government from knowing what the US has learned or to get past the diplomatic breach that followed the incursion.
On 21 May, speaking at a news conference in Hiroshima, Japan, the US President referred to how the balloon incident had paralyzed the already frosty exchanges between Washington and Beijing. “And then this silly balloon that was carrying two freight cars’ worth of spying equipment was flying over the United States,” he told reporters, “and it got shot down, and everything changed in terms of talking to one another.” He predicted that relations would “begin to thaw very shortly.”
China has never acknowledged hacking into American networks, even in the biggest example of all: the theft of security clearance files of roughly 22 million Americans, including six million sets of fingerprints, from the Office of Personnel Management (OPM) during the Obama administration. That exfiltration of data took the better part of a year, and resulted in an agreement between President Barack Obama and President Xi Jinping that resulted in a brief decline in malicious Chinese cyberactivity.
On 24 May, China sent another warning to its companies to be alert to US hacking. And there has been plenty of that, too: In documents released by Edward Snowden, the former NSA contractor, there was evidence of American efforts to hack into Huawei, the Chinese telecommunications giant, and into military and leadership targets. Telecommunications networks are key targets for hackers, and the system in Guam is particularly important to China because military communications often piggyback on commercial networks.
An executive who oversees Microsoft’s threat intelligence unit, said in a recent interview that the company’s analysts, many of them veterans of NSA and other intelligence agencies, had found the code “while investigating intrusion activity impacting a US port.” As they traced back the intrusion, they found other networks that were hit, “including some in the telecommunications sector in Guam.” Microsoft is planning to publish a blog post with detailed indicators about the code, to allow the operators of critical infrastructure to take preventive steps.
In a coordinated announcement, the NSA is expected to publish a technical report about Chinese intrusions into a wide swath of US critical infrastructure. The US report is not expected to refer directly to the Guam incident reported by Microsoft, but it will describe a broader range of Chinese-origin threats.
The current administration has been racing to enforce newly created minimum cybersecurity standards for critical infrastructure. After a Russian ransomware attack on Colonial Pipeline in 2021 that resulted in an interruption of gasoline, diesel and airplane fuel flow on the East Coast, the administration has used the authorities of the Transportation Security Administration (TSA), which regulates pipelines, to force private-sector utilities to follow a series of cybersecurity mandates. A similar process is now underway for water supplies, airports and soon hospitals, all of which hackers have targeted in recent times.
The NSA’s report is part of a relatively new US government move to publish such data quickly in hopes of burning the Chinese operations. In years past, the US usually withheld such information, sometimes classifying it, and shared it with only a select few companies or organizations. But that almost always assured that the hackers could stay well ahead of the government.
In this current case, it was the focus on Guam that particularly seized the attention of officials who are assessing China’s capabilities and its willingness to attack or choke off Taiwan. Mr. Xi has ordered the People’s Liberation Army (PLA) to be capable of taking the island by 2027. But the current CIA director has noted to the US Congress that the order “does not mean he has decided to conduct an invasion.”
In the dozens of US tabletop exercises conducted in recent years to map out what such an attack might look like, one of China’s first anticipated moves would be to cut off American communications and slow the US’ ability to effectively respond. So, the exercises envision attacks on satellite and ground communications, especially around American installations where military assets would be mobilized.
None is bigger than Guam, where Andersen Air Force Base would be the launching point for many of the Air Force missions to help defend the island, and a Navy port is crucial for American submarines. And the clock keeps ticking.
Red Sky Alliance is a Cyber Threat Analysis and Intelligence Service organization. For questions, comments, or assistance, please get in touch with the office directly at 1-844-492-7225, or feedback@redskyalliance.com
Weekly Cyber Intelligence Briefings:
- Reporting: https://www.redskyalliance.org/
- Website: https://www.redskyalliance.com/
- LinkedIn: https://www.linkedin.com/company/64265941
Weekly Cyber Intelligence Briefings:
REDSHORTS - Weekly Cyber Intelligence Briefings
https://attendee.gotowebinar.com/register/5504229295967742989
[1] https://www.msn.com/en-us/news/world/chinese-malware-hits-systems-on-guam-is-taiwan-the-real-target/ar-AA1bDUEz/
Comments