BOSTON (AP) 鈥 State-backed Chinese hackers have been targeting U.S. critical infrastructure and could be laying the technical groundwork for the potential disruption of critical communications between the U.S. and Asia during future crises, Microsoft said Wednesday.
The targets include sites in Guam, where the U.S. has a major military presence, the company said.
Hostile activity in cyberspace 鈥 from espionage to the advanced positioning of malware for potential future attacks 鈥 has become a hallmark of modern geopolitical rivalry.
Microsoft that the state-sponsored group of hackers, which it calls Volt Typhoon, has been active since mid-2021. It said organizations affected by the hacking 鈥 which seeks persistent access 鈥 are in the communications, manufacturing, utility, transportation, construction, maritime, information technology and education sectors.
Separately, the 好色tv Security Agency, the FBI, the Cybersecurity and Infrastructure Security Agency (CISA) and their counterparts from Australia, New Zealand, Canada and Britain sharing technical details on 鈥渢he recently discovered cluster of activity.鈥
A Microsoft spokesman would not say why the software giant was making the announcement now or whether it had recently seen an uptick in targeting of critical infrastructure in Guam or at adjacent U.S. military facilities there, which include a major air base.
John Hultquist, chief analyst at Google's Mandiant cybersecurity intelligence operation, called Microsoft's announcement 鈥減otentially a really important finding."
鈥淲e don鈥檛 see a lot of this sort of probing from China. It鈥檚 rare,鈥 Hultquist said. 鈥淲e know a lot about Russian and North Korean and Iranian cyber-capabilities because they have regularly done this.鈥 China has generally withheld use of the kinds of tools that could be used to seed, not just intelligence-gathering capabilities, but also malware for disruptive attacks in an armed conflict, he added.
Microsoft said the intrusion campaign placed a 鈥渟trong emphasis on stealth鈥 and sought to blend into normal network activity by hacking small-office network equipment, including routers. It said the intruders gained initial access through internet-facing Fortiguard devices, which are engineered to use machine-learning to detect malware.
The maker of Fortiguard devuces, Fortinet, did not immediately respond to an email seeking further details.
鈥淔or years, China has conducted aggressive cyber operations to steal intellectual property and sensitive data from organizations around the globe,鈥 said CISA Director Jen Easterly, urging mitigation of affected networks to prevent possible disruption. Bryan Vorndran, the FBI cyber division assistant director, called the intrusions 鈥渦nacceptable tactics鈥 in the same statement.
Tensions 鈥 which the U.S. national security establishment considers its main military, economic and strategic rival 鈥 have been on the rise in recent months.
Those tensions spiked last year after then-House Speaker Nancy Pelosi鈥檚 , leading China, which claims the island as its territory, to launch military exercises around Taiwan.
U.S.-China relations became further strained earlier this year after the U.S. that had crossed the United States.
