Epoch-Defining Cyber Threat: How China-Backed Hackers Target U.S. Infrastructure

Discover how China-backed hackers pose a growing threat to U.S. critical infrastructure, from telecom breaches to sabotage campaigns. Learn about the Typhoon hacking groups.

China-Backed Cyber Threats: U.S. Critical Infrastructure at Risk

The United States faces an escalating cybersecurity challenge from China-backed hackers, a threat U.S. national security officials have labeled as “epoch-defining.” These state-sponsored groups are accused of infiltrating critical infrastructure networks, including water, energy, and transportation systems, in preparation for potential future conflicts, such as a Chinese invasion of Taiwan.

“China’s hackers are positioning themselves within American infrastructure to cause significant disruption and harm to American communities if and when China decides to act,” warned former FBI Director Christopher Wray in testimony to lawmakers.

Over the past year, the U.S. has ramped up efforts to counter these cyber threats, disrupting operations tied to Chinese hacking groups known collectively as the “Typhoon” family. From botnet takedowns to sanctions against cybersecurity firms aiding these groups, here’s an in-depth look at the evolving landscape of China-backed cyber activities.

Volt Typhoon: Sabotage in the Shadows

Volt Typhoon epitomizes a new wave of Chinese hacking groups focused on disruption rather than espionage. This group aims to undermine the U.S. military’s operational capabilities, particularly in scenarios involving Taiwan. First identified by Microsoft in May 2023, Volt Typhoon has reportedly infiltrated critical infrastructure sectors like aviation, water, energy, and transportation since 2021—if not earlier.

The group exploits vulnerabilities in outdated network devices, including routers and firewalls, to gain entry into U.S. systems. Their ultimate goal, experts say, is to pre-position for future attacks that could paralyze critical services during a conflict.

“This actor is probing sensitive infrastructure, preparing to disrupt major services when the time comes,” explained John Hultquist, chief analyst at Mandiant.

In January 2024, the U.S. disrupted a Volt Typhoon botnet comprising thousands of compromised devices. Through a court-sanctioned operation, the FBI removed malware from hijacked routers, severing the group’s control. Despite these efforts, Volt Typhoon has continued its activities, reportedly targeting over 100 sites across the U.S., including Guam, a strategic military hub. Researchers have also detected novel malware deployed in these attacks, underscoring the high stakes.

Flax Typhoon: Cyber Espionage Masquerading as Business

Operating under the guise of a Beijing-based cybersecurity firm, Flax Typhoon has targeted critical infrastructure in Taiwan, the U.S., and beyond. Active since 2021, the group has used botnets to conduct operations while disguising its activity as routine internet traffic.

In September 2023, U.S. authorities dismantled a botnet linked to Flax Typhoon, comprising hundreds of thousands of hijacked devices. This network facilitated cyber intrusions and data theft, posing a significant threat to global infrastructure. The Department of Justice attributed the botnet’s management to Integrity Technology Group, a publicly traded firm in Beijing. By January 2024, the U.S. had sanctioned the company for its alleged involvement in cyber intrusions.

Salt Typhoon: Espionage with a Dangerous Twist

Salt Typhoon, one of the most recent threats, emerged in late 2024 with a distinct focus on telecom systems. The group compromised networks of major U.S. providers, including AT&T, Verizon, and Lumen, gaining access to metadata from millions of users. Alarmingly, some breaches targeted law enforcement systems used for wiretaps, potentially exposing sensitive government data.

Federal officials suspect Salt Typhoon used vulnerabilities in Cisco routers to infiltrate these systems. While telecom giants have since secured their networks, the breach highlights the attackers’ ability to exploit systemic weaknesses.

Silk Typhoon: An Old Adversary Resurfaces

Previously known as Hafnium, Silk Typhoon returned to the spotlight in December 2024, targeting the U.S. Treasury. Using stolen credentials from BeyondTrust, the group accessed internal Treasury systems, including its sanctions office and the Committee on Foreign Investment in the United States (CFIUS).

Silk Typhoon’s renewed activities underscore its evolving tactics. Initially focused on exploiting Microsoft Exchange vulnerabilities in 2021, the group has since diversified its targets, including healthcare organizations, law firms, and NGOs.

Countering the Threat

The U.S. government’s efforts to curb these cyber threats include disrupting botnets, imposing sanctions, and enhancing collaboration with allies. However, the evolving tactics of these groups demand constant vigilance. Cybersecurity experts emphasize the need for proactive measures, such as patching outdated systems and investing in advanced defenses, to mitigate future risks.

A Call to Action

The growing sophistication of China-backed hacking groups like Volt Typhoon, Flax Typhoon, Salt Typhoon, and Silk Typhoon presents a dire warning. These groups are not merely gathering intelligence but laying the groundwork for potentially devastating cyberattacks. To safeguard critical infrastructure and national security, the U.S. must prioritize robust cybersecurity strategies and international cooperation.

Also Read:  How Overhaul is Revolutionizing Supply Chain Security with AI