Alex Scroxton
The UK’s National Cyber Security Centre (NCSC), alongside intelligence agencies from the Anglophone Five Eyes alliance, has issued guidance highlighting a campaign of Chinese state-sponsored activity targeting critical national infrastructure (CNI) networks.
Working alongside Microsoft – which has attributed the campaign of malicious activity to an advanced persistent threat actor it has dubbed Volt Typhoon having recently revised its threat actor naming taxonomy – the intelligence community’s disclosure includes technical indicators of compromise and examples of the tactics, techniques and procedures being used by the group.
“It is vital that operators of critical national infrastructure take action to prevent attackers hiding on their systems, as described in this joint advisory with our international partners,” said NCSC operations director Paul Chichester.
“We strongly encourage providers of UK essential services to follow our guidance to help detect this malicious activity and prevent persistent compromise.”
According to Microsoft, Volt Typhoon has been active for approximately two years, and has targeted multiple CNI operators in the US Pacific island territory of Guam, as well as in the US itself. Organisations targeted include communications services providers, manufacturers, utilities, transport operators, construction firms, IT companies, educational institutions and government bodies.
According to The New York Times, the focus on Guam is particularly concerning given the territory’s proximity to Taiwan, and its value to the US in mounting a military response in Taiwan’s defence should China attack it.
Microsoft said that based on the behaviour it has observed, Volt Typhoon “intends to perform espionage and maintain access without being detected for as long as possible”.



:quality(70)/cloudfront-us-east-1.images.arcpublishing.com/archetype/7L2IRZWYSBFZFIF5AUYL7YGQOE.jpg)












