Microsoft on Wednesday announced that they have detected Chinese hackers on a number of important cyber infrastructures. The 24-page advisory noted that the affected parties are from a wide range of industries such as transportation, gas utilities to telecommunications in Guam.
The mysterious code was discovered around the time Chinese spy balloons were detected off South Carolina’s coast in February. The code raised alarms as Guam is home to several tactically essential American military bases.
The US National Security Agency said it was working with partners in the UK, Australia, Canada, New Zealand and the F.B.I. to isolate breaches and know how many organizations were affected.
Seasoned Hackers
The hacking has been done by a group called ‘Volt Typhoon’, which is state-sponsored. The group has been in operation since 2021, said Microsoft, with the aim to disrupt the telecommunication infrastructure between the United States and the Asia Pacific region.
The code has been named ‘Web Shell’ which runs a script allowing remote access to a server. It has permeated organizations through the cybersecurity suite, FortiGuard. Once inside the system, the code steals credentials and uses them to gain further access to systems. Older routers that have not been upgraded are especially vulnerable as they don’t have the proper software for protection in place.
The attack is still ongoing. So far it appears the hacks are cyberespionage attempts but it could also be used to disable firewalls. All Microsoft customers have been requested to change their credentials in any compromised account.
Unlike the balloon, which could be shot down, the code has not been removed yet. Microsoft did the next best thing, announce the details of the code. Manufacturers and corporate users can now become aware of the threat and take the necessary steps to remove it.
Officials believe this to be part of a larger coordinated effort of China for intelligence collection.
Experts weigh in their opinion
Tom Burt, security in-charge at Microsoft, mentioned they found the code after a suspicious activity was detected at a U.S. port. Once it was traced back, several more impacted networks and systems were found, in Guam.
President Biden spoke ahead of Wednesday’s announcement, in Hiroshima Japan, on Sunday, about the balloon incident. He recognized that it has halted the already strained conversations between Washington and Beijing. The President predicted that the situation would start to change soon.
China, on the other hand, has never commented or acknowledged the hacking attempts. It issued on the same day, a warning to its companies to be wary of American hacking attempts. This is not new news, according to documents released by Snowden, the former NSA contractor.
While not allowed to operate in the U.S., intelligence agencies like the NSA can publish warnings like the one made on Wednesday. Along with F.B.I. and the Department of Homeland Security’s Cyber Infrastructure and Security Administration’s announcement is a move by the Government to quickly publish data to prevent further damage. This was not the case before where critical information was usually withheld and shared only with a few companies.
