During a speech at Vanderbilt University, FBI Director Christopher Wray drew more attention to the threat from Chinese hacking operations on U.S. critical infrastructure and warned that the situation has become even more urgent. See WaterISAC’s previous coverage of the preeminent cyber threat posed by the PRC.
Wray explained that groups like Volt Typhoon are preparing for the possibility of widespread disruptive actions as early as 2027 and that Chinese hackers are so numerous they outnumber the bureau’s total cyber personnel fifty to one. They have targeted dozens of oil pipeline entities since 2011, as well as entities in the water, energy, and telecommunications sectors, among others. In some cases, they have completely ignored business and financial information in favor of stealing data on control and monitoring systems. U.S. officials have previously described this behavior as "pre-positioning” for future attacks to disrupt or halt critical infrastructure systems.
Director Wray continued that stakeholders across private industry and government need to treat the threat as immediate and implement plans to fortify networks and respond to attacks now. Access Director Wray’s full speech here.
Current guidance to take today to mitigate Volt Typhoon activity:
- Apply patches for internet-facing systems. Prioritize patching critical vulnerabilities in appliances known to be frequently exploited by Volt Typhoon.
- Implement phishing-resistant MFA.
- Change default passwords and do not share passwords or use the same password across multiple systems/applications.
- Ensure logging is turned on for application, access, and security logs and store logs in a central system.
More resources on Director Wray’s speech:
- FBI director warns of China’s preparations for disruptive infrastructure attacks | Cyberscoop
- FBI Director Wray Issues Dire Warning on China's Cybersecurity Threat | Dark Reading
Previous guidance and resources from CISA on Volt Typhoon:
- CISA and Partners Release Advisory on PRC-sponsored Volt Typhoon Activity and Supplemental Living Off the Land Guidance
- PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure
- JOINT GUIDANCE: Identifying and Mitigating Living Off the Land Techniques
Previous WaterISAC Volt Typhoon coverage:
- Reuters Reports U.S. Disrupts Chinese (Volt Typhoon) Threat to Critical Infrastructure
- Disrupted Volt Typhoon Botnet and Testimony on Preeminent Cyber Threat Posed by the PRC
- (TLP:CLEAR) Joint Factsheet – PRC State-Sponsored Cyber Activity: Actions for Critical Infrastructure Leaders
- (TLP:CLEAR) WaterISAC Advisory – PRC-sponsored Volt Typhoon Activity and Supplemental Living Off the Land Guidance
