By Zeba Siddiqui and Christopher Bing
(Reuters) -A state-sponsored&nbsp;Chinese&nbsp;hacking group has been&nbsp;spying&nbsp;on a wide range of U.S.&nbsp;critical&nbsp;infrastructure&nbsp;organizations, from telecommunications to transportation hubs,&nbsp;Western&nbsp;intelligence&nbsp;agencies and Microsoft said on Wednesday.
The espionage has also targeted the U.S. island territory of Guam, home to strategically important American military bases, Microsoft said in a report, adding that "mitigating this attack could be challenging."
While China and the United States routinely spy on each other, analysts say this is one of the largest known&nbsp;Chinese&nbsp;cyber-espionage campaigns against American&nbsp;critical&nbsp;infrastructure.
Chinese&nbsp;foreign ministry spokesperson Mao Ning said on Thursday the hacking allegations were a "collective disinformation campaign" from the Five Eyes countries, a reference to the&nbsp;intelligence&nbsp;sharing grouping of countries made up of the United States, Canada, New Zealand, Australia and the UK.
Mao said the campaign was launched by the U.S. for geopolitical reasons and that the report from Microsoft analysts showed that the U.S. government was expanding its channels of disinformation beyond government agencies.
"But no matter what varied methods are&nbsp;used, none of this can change the fact that the United States is the empire of hacking," she told a regular press briefing in Beijing.
It was not immediately clear how many organizations were affected, but the U.S. National Security Agency (NSA) said it was working with partners including Canada, New Zealand, Australia, and the UK, as well as the U.S. Federal Bureau of Investigation to identify breaches. Canada, UK, Australia and New Zealand warned they could be targeted by the&nbsp;hackers&nbsp;too.
Microsoft analysts said they had "moderate confidence" this&nbsp;Chinese&nbsp;group, which it dubbed as 'Volt Typhoon', was developing capabilities that could disrupt&nbsp;critical&nbsp;communications&nbsp;infrastructure&nbsp;between the United States and Asia region during future crises.
"It means they are preparing for that possibility," said John Hultquist, who heads threat analysis at Google's Mandiant&nbsp;Intelligence.
The&nbsp;Chinese&nbsp;activity is unique and worrying also because analysts don't yet have enough visibility on what this group might be capable of, he added.
"There is greater interest in this actor because of the geopolitical situation."
As China has stepped up military and diplomatic pressure in its claim to democratically governed Taiwan, U.S. President Joe Biden has said he would be willing to&nbsp;use force to defend Taiwan.
Security analysts expect&nbsp;Chinese&nbsp;hackers&nbsp;could target U.S. military networks and other&nbsp;critical&nbsp;infrastructure&nbsp;if China invades Taiwan.
The NSA and other&nbsp;Western&nbsp;cyber agencies urged companies that operate&nbsp;critical&nbsp;infrastructure&nbsp;to identify malicious&nbsp;activity&nbsp;using the technical guidance they issued.
"It is vital that operators of&nbsp;critical&nbsp;national&nbsp;infrastructure&nbsp;take action to prevent attackers hiding on their systems," Paul Chichester, director at the UK's National Cyber Security Centre said in a joint statement with the NSA.
Microsoft said the&nbsp;Chinese&nbsp;hacking group has been active since at least 2021 and has targeted several industries including communications, manufacturing, utility, transportation, construction, maritime, government, information technology, and education.
NSA cybersecurity director Rob Joyce said the&nbsp;Chinese&nbsp;campaign was&nbsp;using "built-in network tools to evade our defenses and leaving no trace behind." Such techniques are harder to detect as they&nbsp;use "capabilities already built into&nbsp;critical&nbsp;infrastructure&nbsp;environments," he added.
As opposed to&nbsp;using traditional hacking techniques, which often involve tricking a victim into downloading malicious&nbsp;files, Microsoft said this group infects a victim's existing systems to find information and extract data.
Guam is home to U.S. military facilities that would be key to responding to any conflict in the Asia-Pacific region. It is also a major communications hub connecting Asia and Australia to the United States by multiple submarine cables.
Bart Hoggeveen, a senior analyst at the Australian Strategic Policy Institute who specializes in state-sponsored cyber attacks in the region, said the submarine cables made Guam "a logical target for the&nbsp;Chinese&nbsp;government" to seek&nbsp;intelligence.
"There is high vulnerability when cables land on shore," he said.
New Zealand said it would work towards identifying any such malicious&nbsp;cyber activity in its country.
"It's important for the national security of our country that we're transparent and upfront with Australians about the threats that we face," Australia's Minister for Home Affairs and Cyber Security Clare O'Neil said.
Canada's cybersecurity agency said it had no reports of Canadian victims of this hacking as yet. "However,&nbsp;Western&nbsp;economies are deeply interconnected," it added. "Much of our&nbsp;infrastructure&nbsp;is closely integrated and an attack on one can impact the other."
(Reporting by Zeba Siddiqui and Christopher Bing; Additional reporting by Kirsty Needham in Sydney, Lucy Craymer in Wellington, Chavi Mehta and Tiyashi Datta in Bengaluru, and Eduardo Baptista in Beijing; Editing by Sonali Paul and Christopher Cushing)

you might like

Chinese hackers spying on US critical infrastructure, Western intelligence says