The “Five Eyes” intelligence agencies (an alliance between the USA, UK, Canada, Australia, and New Zealand) and Microsoft have warned that critical infrastructure in the United States is being targeted by state-sponsored Chinese hackers. The Chinese hacking group, codenamed “Volt Typhoon,” has been operating since mid-2021, according to the reports. The NSA stated that this activity affects networks in critical infrastructure in the United States and believes the group could apply similar techniques worldwide.

The tactics of Volt Typhoon, as described by the Five Eyes advisory, allow them to evade Endpoint Detection and Response (EDR) systems and limit the amount of activity captured in default logging configurations.

China has responded by dismissing the allegations as a “collective disinformation campaign” by the Five Eyes countries. The Chinese Foreign Ministry spokesperson accused the United States of launching the campaign for geopolitical reasons.

The tensions between the West and China have heightened in recent times, and cybersecurity and espionage accusations have become part of the geopolitical landscape between the two sides.

Western companies should be aware of these tensions and the threats that can expand to their activities. Indeed, Canadian authorities have warned businesses operating in sensitive sectors such as technology, defense, or critical infrastructure that they may be at risk of intellectual property theft or unauthorized access to their systems by Chinese hackers.