The United States is facing a serious and immediate threat from a Chinese-backed hacking group known as Volt Typhoon. This group, which has been linked to the Chinese government, has been actively infiltrating U.S. critical infrastructure networks. Despite efforts by U.S. intelligence agencies to counter these cyber threats, officials admit they are still struggling to find an effective way to deter these attacks.
David Frederick, the NSA’s assistant deputy director for China, recently spoke at the Intelligence and National Security Summit about the ongoing threat posed by Volt Typhoon. When asked how the U.S. plans to deter this group from future attacks, Frederick admitted, “I don’t have a good answer to that.” He explained the challenge by saying, “They are trying to position themselves to have an asymmetric advantage in a crisis or conflict. If you look at the cost-benefit from their point of view and just the breadth of targets in the United States and our allies in terms of global networks, they’re not going to be motivated to stop.”
Frederick emphasized that Volt Typhoon’s activities are not aimed at traditional cyber espionage or financial theft. Instead, their goal is to disrupt and potentially cause chaos within the United States’ critical infrastructure, such as power grids, water systems, and transportation networks. He noted, “They’re not there for intelligence. They’re not there for financial motivation. They’re in places like electric, transportation, and ports, trying to hack in so they can cause societal disruption and panic at a time and place of their choosing.”
The Nature of the Threat
Volt Typhoon’s tactics are part of a broader strategy to prepare for potential conflicts, particularly in the Indo-Pacific region, where tensions are high over issues like Taiwan. Frederick explained, “Looking at the strategic context on why China’s conducting these operations is really important. Xi Jinping really sees the U.S. as a block to his goals for national rejuvenation and growth.” He added that China is building a suite of capabilities designed to deter and defeat the United States, with Volt Typhoon’s operations targeting critical infrastructure as a key part of that strategy.
The FBI and other federal agencies have revealed that Volt Typhoon has already compromised the IT environments of multiple U.S. critical infrastructure providers. These infiltrations allow the group to be in a position to disrupt services if there is military escalation involving the United States. This threat is not speculative; it’s ongoing. As recent as early this year, Volt Typhoon was accused of exploiting a zero-day vulnerability in the network management platform Versa Director, aiming to infiltrate technology companies and internet providers, including some in the United States.
The Difficulty in Detection
Volt Typhoon’s methods make them particularly challenging to detect. Rob Joyce, the director of the NSA Cybersecurity Directorate, explained that the group uses “living off the land” techniques. This means they use tools and software that are already present on the networks they infiltrate, avoiding traditional malware that could be flagged by security systems. Joyce noted, “Recent Chinese operations do not rely on traditional or known malware that might be easily flagged based on signatures. Instead, the hackers take advantage of architecture implementation flaws or misconfigurations, or default passwords to get into networks.”
These methods allow Volt Typhoon to operate stealthily, making it harder for traditional cybersecurity defenses to spot their activities. To counter this, the NSA has been using artificial intelligence (AI) and machine learning (ML) technologies to detect unusual patterns of behavior within network systems. Joyce mentioned, “Machine learning, AI, and big data help us surface those activities because the models are better at detecting anomalous behavior of supposedly legitimate users.”
A National Security Crisis
The ongoing threat from Volt Typhoon underscores the broader risks posed by state-sponsored cyberattacks. The Cybersecurity and Infrastructure Security Agency (CISA), along with the NSA and the FBI, have issued warnings about the potential for these hackers to use their access to disrupt or destroy critical infrastructure in the event of geopolitical tensions or military conflict. Eric Goldstein, CISA’s Assistant Director, pointed out that the hackers were in U.S. systems for up to five years, during which they pre-positioned themselves for possible disruptive or destructive cyberattacks.
Goldstein stressed the seriousness of the threat, noting, “The Chinese cyber actors aimed to launch destructive cyber-attacks that would jeopardize the physical safety of Americans and impede military readiness in the event of a major crisis or conflict with the United States.” This ability to disrupt essential services like energy and transportation poses a real threat to the safety and well-being of Americans.
The U.S. government recognizes the critical need to enhance cybersecurity measures and better protect against these sophisticated threats. Morgan Adamski, director of the NSA’s Cybersecurity Collaboration Center, called on network administrators and security teams to be vigilant. She urged them to watch for suspicious activities, particularly those that involve the misuse of legitimate tools instead of malware. “The threat is extremely sophisticated and pervasive,” Adamski said. “It is not easy to find. It is pre-positioning with intent to quietly burrow into critical networks for the long haul. The fact that these actors are in critical infrastructure is unacceptable, and it is something that we are taking very seriously.”
The threat posed by Volt Typhoon requires a coordinated effort from both the public and private sectors. Adamski highlighted the need for collaboration across industries, saying, “We are going to need internet service providers, cloud providers, endpoint companies, cybersecurity companies, device manufacturers, everybody in this fight together. And this is a fight for our U.S. critical infrastructure. The products, the services that we rely on, everything that matters—that’s why this is important.”