Support strong Canadian climate journalism for 2025
State-sponsored hackers from China have been targeting U.S. critical infrastructure, cybersecurity officials from around the world, including Canada, warned Wednesday in a co-ordinated effort to root out the perpetrators.
The Canadian Centre for Cyber Security was just one of several international agencies, all of them part of the Five Eyes intelligence alliance, that took part in amplifying the alert issued by the U.S. National Security Agency.
The discovery of what the NSA described as "indicators of compromise" was first made by Microsoft and attributed to Volt Typhoon, a Chinese state actor that the company said has been active since mid-2021.
Volt Typhoon "typically focuses on espionage and information gathering," the software giant warned in its own threat assessment.
"Microsoft assesses with moderate confidence that this Volt Typhoon campaign is pursuing development of capabilities that could disrupt critical communications infrastructure between the United States and Asia region during future crises."
Rob Joyce, the director of cybersecurity for the NSA, described the style of attack as "living off the land" — using existing network tools and valid credentials to better avoid detection.
"A (People's Republic of China) state-sponsored actor is living off the land, using built-in network tools to evade our defences and leaving no trace behind," Joyce said in a statement.
"That makes it imperative for us to work together to find and remove the actor from our critical networks."
The Microsoft report describes stealth as one of the interloper's key goals in order to maintain access to the target network, which is why it relies on existing administrative tools and "hands-on-keyboard" activity to avoid detection.
"In addition, Volt Typhoon tries to blend into normal network activity by routing traffic through compromised small office and home office network equipment, including routers, firewalls and VPN hardware."
Microsoft said Volt Typhoon has already targeted infrastructure facilities around the U.S., including in Guam, where the U.S. maintains an air force base and naval port, both of which are central elements of its military presence in the Pacific Ocean.
Pentagon officials also believe Guam and its military installations were among the principal targets of the Chinese spy balloon that was shot down in February after a week of drifting through North American airspace.
Canadian officials say there have been no reports of any systems inside Canada being targeted.
"The Canadian Centre for Cyber Security joins its international partners in sharing this newly identified threat and accompanying mitigation measures with critical infrastructure sectors," agency head Sami Khoury said in a statement.
"The interconnected nature of our infrastructures and economies highlights the importance of working together with our allies to identify and share real-time threat information."
Other agencies taking part in Wednesday's announcement included the U.S. Cybersecurity and Infrastructure Security Agency, the FBI and cybersecurity agencies in Australia, New Zealand and the U.K.
"For years, China has conducted operations worldwide to steal intellectual property and sensitive data from critical infrastructure organizations around the globe," said CISA director Jen Easterly.
"(Wednesday's) advisory, put out in conjunction with our U.S. and international partners, reflects how China is using highly sophisticated means to target our nation's critical infrastructure."
This report by The Canadian Press was first published May 24, 2023.
Comments
As an IT guy, the Russian and Chinese hackers have been actively targeting Canadian healthcare, utilities and other vital infrastructure for some time, this is nothing new.
The bigger problem is that too many organizations rely on security software to detect hacking activity, this is not enough. Applications facing the Internet need to also log and report bad activity, otherwise it is too late by the time the security software detects the activity.
Daily active monitor is a must physically, relying on security software is not enough to protect your network. Organizations have become too reliant on it. The software is just not intelligent enough to detect all hacking activity until it is too late. AI however, may make a difference once it matures enough in this area.
We have actively blocked most Russian and Chinese know hack points to prevent them from even accessing applications, but again this must be monitored constantly. Both tend to use foreign end points in other countries, including the USA, to carry out their activities. New ones pop up every few days.
Security is a 24/7 job and security software alone just doesn't cut it these days to protect vital systems and infrastructure.