Embed
Chinese government hackers are secretly burrowing into critical networks using creative new methods.
Chinese government hackers have spent the last several years quietly burrowing into critical networks using novel tactics to try and stay hidden. However, some cybersecurity researchers have been able to stay on their tails. NPR's Jenna McLaughlin has the story.
JENNA MCLAUGHLIN, BYLINE: Michael Horka has been watching network traffic flowing along the backbone of the internet for years.
MICHAEL HORKA: I'm a principal information security analyst at Lumen's Black Lotus Labs. We identify, track and disrupt nation state and criminal threat actors as they traverse the internet.
MCLAUGHLIN: Lumen is a major telecommunications company that helps route network traffic. While hackers can cover some tracks, they can't fully hide all their digital footprints. But they sure are trying.
HORKA: It definitely felt like a wild goose chase a lot of times.
MCLAUGHLIN: That leads us to Volt Typhoon, a Chinese government hacking group that U.S. national security officials have said is focused on secretly getting access to key strategic targets.
HORKA: Heavy in the government and defense sector, telecommunications, broad communications in general, critical infrastructure. We've got water, rail, aviation.
MCLAUGHLIN: Officials say those targets aren't by accident. They're great for intelligence gathering, but adversaries could also cause physical damage, like shut off the power or cut off access to ports, for example, creating societal panic or preventing the U.S. military from responding quickly in the event of a conflict. It's been a focus for years. That hasn't changed, but they've gotten a lot sneakier, Horka says. These hackers have created a roadmap for accessing critical networks that Horka's team at Black Lotus is calling Silent Train.
HORKA: It was a lot of thread pulling, but as we pulled on those threads, we eventually made it back to somewhat of a reproducible pattern - a reproducible network pattern that we were able to signature.
MCLAUGHLIN: In other words, these hackers would create a new winding pathway through up to six different virtual networks and compromised devices like routers to get to their ultimate destination every single time, never retracing their steps. Meanwhile, they used previously undiscovered vulnerabilities and covered their tracks behind them.
HORKA: They were purposely trying to stay extremely quiet.
MCLAUGHLIN: Beyond the novel spy tactics, there's a larger message Horka wants to send - that these hackers are highly motivated and willing to invest in these operations. Defenders need to do the same.
HORKA: It's important for network defenders and threat hunters to put on that black hat for a moment and just think, like, hey, if this is really valuable to us as an organization, it would probably be a target as well.
MCLAUGHLIN: Horka hopes that exposing Volt Typhoon's trade craft might at least make it harder for them to hide.
HORKA: If I had to use an analogy, if the pond water has just been sitting for so long and nothing's happening, and there's nothing you can do, like, we're dropping a rock in it, and we're going to see what happens.
MCLAUGHLIN: Horka will be watching to see the ripples.
Jenna McLaughlin, NPR News.
(SOUNDBITE OF REFUGEE CAMP ALL-STARS SONG, "THE SWEETEST THING (FEAT LAURYN HILL)")
Accuracy and availability of transcripts for NPR programming may vary. Transcript text may also be revised to correct errors or match updates to audio. Audio may be edited after its original broadcast or publication. The authoritative record of NPR’s programming is the audio record. Please note that NPR platforms and products also include some programming produced by third parties; NPR cannot guarantee transcripts for that content and some transcripts may be produced using automated or other tools.
NPR does not offer or accept money for coverage or interviews. Anyone who makes such an offer or request is not an NPR employee and does not represent NPR.
Support mission-driven journalism while getting something great in return. Enjoy bonus content, early access and sponsor-free listening from your favorite NPR podcasts.
Already have NPR+? Sign In
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
