SoylentNews

Arthur T Knackerbracket has processed the following story:

The US government today confirmed China's Volt Typhoon crew comprised "multiple" critical infrastructure orgs' IT networks in America – and Uncle Sam warned that the Beijing-backed spies are readying "disruptive or destructive cyberattacks" against those targets.

The Chinese team remotely broke into IT environments — primarily across communications, energy, transportation systems, and water and wastewater system sectors — in the continental and non-continental United States and its territories, including Guam.

"Volt Typhoon's choice of targets and pattern of behavior is not consistent with traditional cyber espionage or intelligence gathering operations, and the US authoring agencies assess with high confidence that Volt Typhoon actors are pre-positioning themselves on IT networks to enable lateral movement to OT assets to disrupt functions," a dozen Five Eyes government agencies warned on Wednesday. 

[...] According to the US agencies, Volt Typhoon will likely use any network access it can get to pull off disruptive attacks against American systems and equipment in the event of geopolitical tensions or military conflicts.

[...] While the threat to American critical infrastructure appears to be the highest, should US facilities be disrupted, "Canada would likely be affected as well, due to cross-border integration," according to CCCS. 

Australian and New Zealand critical infrastructure could be vulnerable as well.

In addition to sounding the alarm, the government bodies issued a long list of technical details, TTPs observed in the digital break-ins, and detection recommendations and best practices. 

Plus, there's three actions that owners and operators should take "today" to mitigate the threat.

These include: Apply patches for internet-facing systems with priority given to appliances that Volt Typhoon likes to exploit. 

Second: Turn on phishing-resistant multi-factor authentication (MFA).

And finally, ensure that logging is turned on for applications, access and security logs, and store these logs in a centralized system.

Original Submission