US says China’s Bolt Typhoon is preparing for devastating cyber attack • The Register

The U.S. government today confirmed that China’s Bolt Typhoon crew was comprised of IT networks from “multiple” critical infrastructure organizations in the United States, and Uncle Sam was suspected of being a Chinese government-backed spy. warned that it was preparing “destructive or devastating cyber-attacks” against these targets.

Chinese teams remotely penetrated IT environments across the continental and non-continental United States and its territories, including Guam, primarily in the communications, energy, transportation systems, and water and wastewater systems sectors.

“Bolt Typhoon’s selection of targets and behavior patterns are inconsistent with traditional cyber espionage and intelligence gathering operations, and the U.S. authoring agency believes Bolt Typhoon attackers could move laterally into OT assets.” “We have a high degree of confidence that they are pre-located on IT networks in order to disrupt their functionality,” more than a dozen Western government agencies warned on Wednesday.

The creating institutions are as follows. U.S. Cybersecurity and Infrastructure Security Agency (CISA), U.S. National Security Agency (NSA), U.S. Federal Bureau of Investigation (FBI), U.S. Department of Energy (DOE), U.S. Environmental Protection Agency (EPA), U.S. Transportation Security Administration ( TSA), the Australian Cyber ​​Security Center (ACSC) of the Australian Signals Directorate (ASD), the Canadian Cyber ​​Security Center (CCCS), part of the Communications Security Establishment (CSE), the UK National Cyber ​​Security Center (NCSC-) UK); New Zealand National Cyber ​​Security Center (NCSC-NZ).

According to U.S. government agencies, Bolt Typhoon could use any available network access to carry out devastating attacks on U.S. systems and equipment in the event of geopolitical tensions or military conflict. is high.

This follows a similar warning from FBI Director Christopher Wray last week that Chinese attackers were preparing to “wreak havoc” on America’s infrastructure, and a similar warning from FBI Director Christopher Wray last week that Chinese attackers were preparing to “wreak havoc” on American infrastructure, and that Bolt Typhoons were preparing “hundreds of This follows the Department of Justice’s revelation that it had infected several older Cisco and Netgear devices with malware. Infiltrated critical infrastructure facilities in the United States.

The threat to U.S. critical infrastructure appears to be highest, but if U.S. facilities are disrupted, “Canada would likely be affected as well due to cross-border integration,” CCCS said.

Critical infrastructure in Australia and New Zealand could be similarly vulnerable.

In addition to sounding the alarm, the agency issued technical details, TTPs observed in digital intrusions, and a long list of detection recommendations and best practices.

Additionally, there are three actions owners and operators should take today to mitigate the threat.

Patch internet-facing systems and prioritize appliances that Vault Typhoon exploits.

Second: Enable phishing-resistant multi-factor authentication (MFA).

Finally, ensure that logging is enabled for application, access, and security logs, and store these logs in a central system. ®