Feds still trying to crack Volt Typhoon hackers’ intentions, goals

Federal cybersecurity officials are still grappling with a critical question surrounding the persistent threat posed by the Chinese state-sponsored hacking group known as Volt Typhoon: What are their ultimate intentions?

The group, which has successfully infiltrated critical infrastructure sectors across the United States and its territories, including telecommunications, energy, and water systems, has been a major focus of federal agencies like the Cybersecurity and Infrastructure Security Agency (CISA) and the FBI. However, even with successful operations to dismantle portions of the group’s network, a clear understanding of their end-game remains elusive.

According to a CISA official, federal analysts are still “sizing up” the potential impact and what to do about the Chinese hackers who have maintained access within U.S. networks. The official noted that while the group’s presence in these systems is confirmed, including in strategically important locations like Guam, the resulting impacts are still unknown.

Unlike traditional cyber espionage campaigns focused on data theft, Volt Typhoon’s behavior suggests a different, more ominous goal. The hackers are not merely collecting intelligence; they are pre-positioning themselves in critical infrastructure with the ability to cause disruptive or destructive effects should geopolitical tensions escalate.

The threat is seen as a strategic military maneuver by China’s People’s Liberation Army. By gaining persistent access to operational technology (OT) environments, Volt Typhoon could potentially disrupt essential services, from port operations to power grids. Officials are worried about the “second- and third-order effects” of such an attack. For example, a targeted attack on cargo management systems could effectively shut down ports and cripple the nation’s transportation network.

While the FBI has had some success in disrupting the group’s operations by removing malware from compromised devices, the group has proven resilient, quickly rebuilding parts of its botnet. This ongoing campaign, and the difficulty in fully understanding its scope and ultimate goals, underscores the challenges facing the U.S. government in a new era of cyber warfare.