Mediaboss Marketing

FORT MEADE, MARYLAND The U.S. government has yet to learn the full extent of a massive Chinese espionage campaign that targeted American critical infrastructure, according to a senior National Security Agency official.

Federal agencies are not done with efforts to uncover or eradicate the threats created by the Chinese hacking group known as Volt Typhoon, said Rob Joyce, the outgoing director of the NSAs Cybersecurity Directorate, during a roundtable with reporters on Friday.

Investigators are still finding victims and making sure to clear out intrusions tied to the sweeping operation, which Western nations first disclosed nearly a year ago, he said.

Joyce also acknowledged for the first time that the government used artificial intelligence to discover some of the breaches made during the campaign, noting that Volt Typhoon activity was difficult to initially identify because the group steals or generates legitimate credentials and doesnt bring additional malware into a system.

Conversely, Joyce said he has seen no examples of them using AI to date. Instead, the prolific, state-sponsored outfit relies on bulk vulnerability scans to sniff out and exploit known weaknesses.

Joyce declined to comment on just how much of the operation the federal government has unearthed to date.

The new insights come a few weeks after some of the countrys top cybersecurity leaders issued stark warnings about the ability of Volt Typhoon and other Chinese hackers to compromise U.S. networks should a conflict with Beijing arise.

"Unfortunately, the technology underpinning our critical infrastructure is inherently insecure because of decades of software developers not being held liable for defective technology," Jen Easterly, director of the Cybersecurity and Infrastructure Security Agency (CISA) told the House Select Committee on China.

"That has led to incentives where features and speed to market have been prioritized against security, leaving our nation vulnerable to cyber invasion, she said during the January 31 hearing.

That same day, the Justice Department announced it had disrupted an effort by Volt Typhoon to infiltrate hundreds of insecure U.S. home routers and gain access to critical infrastructure.

The U.S. and its allies revealed the groups actions last May when analysts at Microsoft found it had targeted systems ranging from U.S. telecommunication networks and transportation hubs to the military installation on the island territory of Guam.

Since then, the Biden administration has published over six digital security adversaries warning of the Volt Typhoons tactics and techniques.

From the beginning, its been a broad campaign, said Joyce, who noted targets included airlines as well as energy and pipeline organizations.

The intent really goes back to inspiring societal panic, he said.

That would, in turn, force the U.S. to turn inward and prevent the nation from being able to mobilize and support a conflict in the South Pacific, he told reporters, adding the view of the activity changed as we expanded our knowledge about it

That said, officials believe it would be a pretty high bar for Beijing to activate the groups pre-positioning in Western networks, according to Joyce.

He told reporters he hoped Chinese officials would be thoughtful following the national anger at the discovery of Beijings high-altitude balloon campaign last year.

Chinas military sorely underestimated the countrys response to that event, an anger that would only grow if state-backed hackers struck water and transportation systems, he predicted.

Joyce, who was the NSAs initial pick to be its latest No. 2, instead will retire at the end of the month.

He will be replaced by Dave Luber, who has held various posts at U.S. Cyber Command and has served as the Cybersecurity Directorates deputy chief for almost the last four years.

Recorded Future

Intelligence Cloud.

No previous article

No new articles

Martin Matishak

is the senior cybersecurity reporter for The Record. Prior to joining Recorded Future News in 2021, he spent more than five years at Politico, where he covered digital and national security developments across Capitol Hill, the Pentagon and the U.S. intelligence community. He previously was a reporter at The Hill, National Journal Group and Inside Washington Publishers.

The rest is here:
US is still chasing down pieces of Chinese hacking operation, NSA official says - The Record from Recorded Future News

Tags: