Alexander Noyes
When federal agents walked into the municipal utility building in Littleton, Massachusetts, in late 2023, they carried a warning that should have wounded Americans’ sense of security. Chinese state-backed operators had penetrated the town’s water system, quietly compromising its control network for years. Their goal was not espionage or theft but leverage—the ability to sow chaos in the United States and deter U.S. action abroad in the event of a future conflict.
Littleton was not an isolated event. In February 2024, U.S. federal agencies disclosed new details about Volt Typhoon, a Chinese state-sponsored hacking group first identified in 2023, revealing that it had compromised critical infrastructure networks in the communications, energy, transportation, water, and government sectors. Using “living off the land” techniques that mimic legitimate network activity, the hackers set up their positions and remained undetected for years; Microsoft, which first documented the campaign in 2023, reported that it had been active since at least 2021. Other infrastructure hubs, including the Port of Houston and New York’s Metropolitan Transportation Authority, have also been targeted in separate but related campaigns that used similar intrusion methods. Although not all of these operations were directly linked to Volt Typhoon, they shared its hallmarks: stealthy network access, the exploitation of legitimate administrative tools such as PowerShell, Windows Management Instrumentation, remote desktop services, and network management utilities, and pre-positioning for potential future attacks. The U.S. government still lacks a full picture of how far such operations extend.