Natto Thoughts: Volt Typhoon

Who is Volt Typhoon? A State-sponsored Actor? Or Dark Power?

Natto Team — Wed, 12 Jun 2024 16:00:05 GMT

Revelations about the Volt Typhoon hacking group’s targeting of US critical infrastructure shows Chinese cyber operations have permanently altered the cyberthreat landscape, US officials said at the RSA cybersecurity conference in early May. “China has moved beyond the traditional goal of nation-state hacking operations – spying on an adversary – into something more sinister.” If we recall, this was not the first time this year that US officials have called out the significance of Volt Typhoon campaigns. At the end of January, after the US Department of Justice (US DoJ) took down a botnet allegedly used by Volt Typhoon, US officials pointed out that China’s “historical focus on stealing state secrets and espionage,” meaning cyber espionage for political and economic interests, has evolved into a more ominous intention to prepare for destructive attacks. As US officials said, Volt Typhoon campaigns show “a new interest in preparing and launching destructive cyberattacks against US ele…

When “Volt Typhoon” Blows Over: Cases of China’s Offensive Cyber Operation

Natto Team — Fri, 09 Feb 2024 02:31:23 GMT

Source: NASA Earth Observatory

Last Wednesday, January 31, a press release from the United State Department of Justice stated the US government has taken down a botnet used by Volt Typhoon, a Chinese state-sponsored advanced persistent threat (APT) group targeting US critical infrastructure. In testimony before a committee of the US House of Representatives, FBI director Chris Wray warned “Chinese government hackers are busily targeting water treatment plants, the electrical grid, transportation systems and other critical infrastructure inside the US,” … “in preparation to wreak havoc and cause real-world harm to American citizens and communities…”

The state-backed Chinese threat group Volt Typhoon first came to public attention in May 2023 when Microsoft reported the group’s “stealthy and targeted malicious activity focused on post-compromise credential access and network system discovery aimed at critical infrastructure organizations in the US.” Microsoft assessed the “Volt Typhoon c…