The People's Republic of China is accelerating the development of its military capabilities - including cyber operations - because it believes it will need to deter and confront the United States, US officials said yesterday.
China-linked cyberattackers have increasingly focused on critical infrastructure systems in particular as part of a campaign by Beijing to be ready for a broader conflict, according to experts - a distinct change in strategy by China, the experts said.
The highly active threat group Volt Typhoon has conducted attacks against the US government and defense contractors since at least 2021, but since last May it has been recognized as a threat to critical infrastructure and military bases.
It's seen as such a clear threat that it was recently disrupted by the US government and private sector companies, officials said this week.
For the most part the attacks have either been cybercriminal efforts looking for a payday or espionage operations targeted at stealing government secrets and corporate intellectual property.
The notorious Chinese cyber-espionage group APT1, for example, represents a team run by the People's Liberation Army, details of which were first published by Mandiant in 2013.
While Chinese hackers are still stealing data, conducting cybercrimes, and targeting dissidents, industry sources are confirming the shift toward disruption-readiness flagged by the US government.
Wray also used the testimony to argue for the FBI's budget and for foreign surveillance powers.
Any reduction to the FBI's budget would hurt the agency's ability to monitor and foil preparatory attacks by Chinese actors, he said.
Industrial Cyberattacks Getting Harder to Detect A key tactical component of the latest Chinese cyberattacks on critical infrastructure has been the compromise of small-office, home-office routers - the assailants, including Volt Typhoon, are then using those compromises to cover the source of later attacks.
The focus on small business routers underscored once again that unmanaged technologies have become a national security liability.
Of the 34 router vulnerabilities currently in CISA's Known Exploited Vulnerabilities catalog, nine appear to have no patches available from the manufacturers, Veracode's Wysopal noted.
Overall, US technology firms and their customers - both businesses and individuals - need to take stock of how their use of technology, and failure to maintain that technology, may be contributing to the threat to critical infrastructure, says Lisa Plaggemier, executive director at the National Cybersecurity Alliance, a nonprofit cybersecurity education and outreach organization.
This Cyber News was published on www.darkreading.com. Publication date: Thu, 01 Feb 2024 20:30:31 +0000