A U.S. law enforcement operation in December disrupted a botnet of hundreds of routers operated by Chinese nation-state actors.
The campaign has raised concerns about potentially destructive cyberattacks from the country.
The law enforcement operation that led to the takedown, the DOJ said, was court authorized in December and led by the FBI Houston Field Office and Cyber Division, U.S. Attorney's Office for the Southern District of Texas and the National Security Cyber Section of the Justice Department's National Security Division.
Reuters first reported the disruption of the Chinese hacking campaign Monday.
U.S. agencies have previously tracked and disclosed threat activity from Volt Typhoon, which has been active since mid-2021.
Last spring, Microsoft published a report on Volt Typhoon's targeting of critical infrastructure organizations in Guam and the U.S. While the threat group usually engaged in cyber espionage, the tech giant warned that Volt Typhoon's goals might have changed.
The detection and disruption of the KV botnet has stoked additional concerns within the U.S. government.
During a Wednesday hearing before the House Select Committee on Strategic Competition Between the United States and the Chinese Communist Party regarding the takedown, CISA Director Jen Easterly testified about the threat posed by the recent Chinese cyber activity.
FBI Director Christopher Wray made similar remarks in his opening statement and said Chinese hacking operations posed enormous risk to U.S. civilian critical infrastructure.
In a CISA cybersecurity advisory from May that offered additional technical insights into Volt Typhoon, the agency said the nation-state threat group used living off the land techniques, meaning it uses built-in network administration tools such as PowerShell, wmic, and ntdsutil to avoid endpoint detection and response products.
The agency also published a resource guide on Wednesday with secure by design recommendations for SOHO router manufacturers.
Despite the concerns over Chinese hacking operations, Sandra Joyce, vice president of Mandiant Intelligence at Google Cloud, expressed optimism about the fight against Volt.
TechTarget Editorial contacted the FBI for additional comment.
Alexander Culafi is an information security news writer, journalist and podcaster based in Boston.
This Cyber News was published on www.techtarget.com. Publication date: Thu, 01 Feb 2024 19:43:04 +0000