By Raphael Satter, Zeba Siddiqui and James Pearson
(Reuters) -The&nbsp;U.S. State Department warned on Thursday that&nbsp;China&nbsp;was capable of launching cyber attacks against critical&nbsp;infrastructure,&nbsp;including&nbsp;oil and gas&nbsp;pipelines&nbsp;and&nbsp;rail&nbsp;systems, after researchers discovered a Chinese&nbsp;hacking group had been spying on such networks.
A multi-nation alert issued Wednesday revealed the Chinese cyber-espionage campaign had been aimed at military and government targets in the United States.
The Chinese government has rejected assertions that its spies are going after Western targets, calling the warning issued by the United States and its allies a "collective disinformation campaign."
U.S. officials said they were still in the process of getting their arms around the threat.
"We&rsquo;ve had at least one location that we didn&rsquo;t know about since the hunt guide was released come forward with data and information," Rob Joyce, the&nbsp;U.S. National Security Agency's (NSA) cybersecurity director, told Reuters. The agency disclosed technical details earlier to help critical service providers detect the spying.
The&nbsp;U.S. Cybersecurity and&nbsp;Infrastructure&nbsp;Security Agency (CISA) separately said it was working to understand "the breadth of potential intrusions and associated impacts."
That would help it "provide assistance where needed, and more effectively understand the tactics undertaken by this adversary," CISA's executive assistant director, Eric Goldstein, told Reuters.
Part of the challenge in defending against this espionage work is that it's more covert than regular spy operations, according to researchers and officials.
"In these cases the adversary is often using legitimate credentials and legitimate network administration tools to gain access to execute their objectives on a target network," Goldstein said. "Many traditional methods of detection, such as antivirus, will not find these intrusions."
Microsoft analysts who identified the campaign, which they dubbed Volt Typhoon, said it "could&nbsp;disrupt critical communications&nbsp;infrastructure&nbsp;between the United States and Asia region during future crises" - a nod to escalating&nbsp;U.S.-China&nbsp;tensions over Taiwan and other issues.
"The&nbsp;U.S. intelligence community assesses that&nbsp;China&nbsp;almost certainly is capable of launching cyberattacks that&nbsp;could&nbsp;disrupt critical&nbsp;infrastructure&nbsp;services within the United States,&nbsp;including&nbsp;against oil and gas&nbsp;pipelines&nbsp;and&nbsp;rail&nbsp;systems," State Department spokesperson Matthew Miller said in a press briefing.
"It's vital for government and network defenders in the public to stay vigilant."
U.S. agencies have been pushing for improved cybersecurity practices in its majority-privately held critical&nbsp;infrastructure&nbsp;industry, after the 2021&nbsp;hack&nbsp;of the key Colonial Pipeline disrupted nearly half of the&nbsp;U.S. East Coast&rsquo;s fuel supply.
Intelligence agencies in the United States, Britain and their close allies issued an alert Wednesday to warn about Volt Typhoon. Microsoft said the group had targeted critical&nbsp;infrastructure&nbsp;organizations in the&nbsp;U.S. Pacific territory of Guam, and it was using the security firm Fortinet's FortiGuard devices to break into target's networks.
Researcher Marc Burnard, whose organisation Secureworks has dealt with several intrusions tied to Volt Typhoon, said Secureworks had seen no evidence of destructive activity by Volt Typhoon, but that its&nbsp;hackers were focused on stealing information that would "shed light on&nbsp;U.S. military activities."
NSA's Joyce said there was no doubt Volt Typhoon was putting itself in position to carry out disruptive attacks.
"It&rsquo;s clear that some of the entities on here are of no intelligence value," he told Reuters of the critical&nbsp;infrastructure&nbsp;sites identified by the government.
Chinese foreign ministry spokesperson Mao Ning told reporters that the alerts issued by the United States, Britain, Canada, Australia and New Zealand were intended to promote their intelligence alliance - known as the Five Eyes - and it was Washington that was guilty of&nbsp;hacking.
"The United States is the empire of&nbsp;hacking," Mao said.
(Additional reporting by Christopher Bing and Daphne Psaledakis; editing by William Maclean, Mark Heinrich, Chizu Nomiyama and Leslie Adler)

you might like

U.S. warns China could hack infrastructure, including pipelines, rail systems