Chinese threat actors are positioning themselves to deploy major cyber-attacks against US critical national infrastructure (CNI) in the event of an escalation of hostilities between the two nations.
Microsoft’s latest Digital Defense Report (MDDR) observed a rise in Chinese state-affiliated actors, such as Circle Typhoon and Volt Typhoon, targeting sectors like transportation, utilities, medical infrastructure and telecommunications.
These campaigns may be intended to enable China to disrupt critical infrastructure and communication between the US and Asia during a geopolitical crisis, the tech giant believes.
Speaking ahead of the report’s release, Tom Burt, corporate vice president, customer security & trust at Microsoft, explained that many of these targets have little to no espionage or intelligence gathering benefit.
“The apparent motivation for this series of cyber-attacks is to preposition access so that they would have the opportunity to disrupt the provision of critical infrastructure services in the event of escalation of hostilities,” he said.
The report noted that these attacks often use unobtrusive techniques and originate from compromised Fortinet devices.
Burt added that Chinese and Russian-linked actors are utilizing sophisticated ‘living off the land’ techniques once they have infiltrated networks, making detection challenging even for experienced incident responders and security operation center (SOC) teams.
“Once they gain access to a network, rather than dropping malware down into that network which is easier to detect and potentially exclude from a network, they utilize the capabilities of the network itself to conduct their pivoting, investigations and exfiltration of data,” he explained.
Microsoft’s analysis follows claims from the US Department of Defense (DoD) in September 2023 that China’s malicious cyber activity informs its preparations for a potential military conflict with the US.
No tags.
