Korva is a scroll of the internet’s best ideas.
Chinese hackers pre-positioned inside power grids
Planted in the grid
In 2023, Microsoft and a group of US federal agencies, including the National Security Agency, revealed that the group had broken into those networks, mostly around military facilities in the continental US and Guam. They described it as pre-positioning: planting malicious code that could be used at a time of the hackers' choosing to disrupt electricity to military bases. The theory that developed was that China was preparing for an invasion of Taiwan and wanted to be able to delay or disrupt a US response.
Civilian targets too
Over the following year it became clear that Volt Typhoon had also broken into a great deal of civilian infrastructure. The chief security officer of a utility in Littleton, Massachusetts, a town of about 10,000 people, had no idea why Chinese military hackers would want the ability to disrupt electricity and water flow to his town.
The wider theory
The theory in the cybersecurity community has since widened: China may be trying to disrupt US society as a whole, preparing a catastrophic hack of civilian infrastructure that would cause what many government officials and cybersecurity experts describe as societal chaos.
Why does pre-positioning matter to militaries?
Access gained in advance lets an attack begin the moment it is ordered, without needing to break into a network during a crisis when defenders are already alert. It also gives the attacker time to study how a system works. The US Cybersecurity and Infrastructure Security Agency said in a February 2024 advisory that Volt Typhoon had maintained access in some critical infrastructure networks for at least five years.
How do hackers hide inside normal network traffic?
Microsoft's 2023 analysis found that Volt Typhoon relied on tools already built into the systems it entered, so its activity looked like routine administration. It also routed its traffic through compromised small-office and home routers, which made the connections appear to come from ordinary US addresses. In January 2024, the US Justice Department announced a court-authorized operation that disrupted a network of hundreds of such routers.
Why would Guam matter in a Taiwan conflict?
Guam is a US territory about 1,700 miles from Taiwan and serves as a forward hub in the western Pacific. It hosts Andersen Air Force Base, which supports long-range bombers, and a major US Navy base. Military planners have long treated the island as a staging point for any US response in the region.
More from Fresh Air
