Around the time the Federal Bureau of Investigation was examining equipment recovered from the wreckage of the Chinese spy balloon shot down off the coast of South Carolina in February, U.S. intelligence agencies and Microsoft discovered what they believed to be a more worrisome intruder: mysterious computer code that has been popping up in telecommunications systems in Guam and elsewhere in the United States.
The code, which Microsoft says was installed by a Chinese government hacking group, raised alarm because Guam, with its Pacific ports and sprawling U.S. airbase, would be an important part of any U.S. military response to an invasion or blockade of Taiwan. It was installed with great stealth, sometimes through routers and other common consumer devices connected to the Internet, to make the intrusion more difficult to detect.
But unlike the balloon that captivated Americans as it pirouetted over sensitive nuclear sites, the computer code couldn’t be shot down on live television. So instead, Microsoft and the National Security Agency would publish details of the code on Wednesday that would allow business users, manufacturers and others to detect and remove it.
The code is called a “web shell,” in this case a malicious script that allows remote access to a server. Home routers are particularly vulnerable, especially older models that lack updated software and protections.
Microsoft dubbed the hacking group “Volt Typhoon” and said it was part of a state-sponsored Chinese effort targeting not only critical infrastructure such as communications, electricity and gas supplies, but also maritime operations and transportation. The break-ins appeared to be an espionage campaign for the time being. But the Chinese could use the code designed to breach firewalls to enable destructive attacks if they wanted to.
So far, Microsoft says, there is no evidence that the Chinese group has used the access for offensive attacks. Unlike Russian groups, China’s intelligence services and military hackers usually prioritize espionage.
In interviews, government officials said they believed the code was part of an extensive Chinese intelligence-gathering effort that spanned cyberspace, outer space, and, as Americans discovered with the balloon incident, the lower atmosphere.
The Biden administration has declined to comment on what the FBI found when examining the equipment recovered from the balloon. But the craft — better described as a massive aircraft — apparently contained specialized radars and communications intercept equipment that the FBI has been investigating since the balloon was shot down.
It’s unclear whether the government’s silence on the balloon’s discovery was motivated by a desire to dissuade the Chinese government from knowing what the United States learned or to get past the diplomatic rift that followed the raid.
On Sunday, at a news conference in Hiroshima, Japan, President Biden referred to how the balloon incident had paralyzed the already frosty exchanges between Washington and Beijing.
“And then this silly balloon with spy equipment flew across the United States in two boxcars,” he told reporters, “and he got shot down and everything changed in terms of talking to each other.”
He predicted that relations would “start to thaw very soon”.
Telecommunications networks are prime targets for hackers, and the system in Guam is especially important to China because military communications often piggyback on commercial networks.
Tom Burt, the executive overseeing Microsoft’s threat intelligence unit, said in an interview that the company’s analysts — many of them veterans of the National Security Agency and other intelligence agencies — found the code “while investigating burglary activity that hit a US port”. When they traced the intrusion, they found other networks affected, “including some in the telecommunications sector in Guam.”
Microsoft planned to publish a blog post on Wednesday with detailed indicators about the code so that critical infrastructure operators can take preventive action.
In a coordinated announcement, the NSA is expected to release a technical report on Chinese intrusions into much of America’s critical infrastructure. The US report is not expected to refer directly to the Guam incident reported by Microsoft, but it will detail a broader range of threats of Chinese origin.
The Biden administration is racing to enforce the newly created minimum cybersecurity standards for critical infrastructure. After a Russian ransomware attack on Colonial Pipeline in 2021 that resulted in an interruption of gasoline, diesel and jet fuel flow on the East Coast, the government has used the authorities of the Transportation Security Administration – which regulates pipelines – to force private utilities to to follow a series of cybersecurity mandates.
A similar process is now underway for water supplies, airports and soon hospitals, all of which have been attacked by hackers in recent times.
The National Security Agency report is part of a relatively new move by the US government to quickly publish such data in hopes of setting fire to China’s operations. In recent years, the United States commonly withheld such information — sometimes by classifying it — and shared it with only a select few companies or organizations. But that almost always ensured that the hackers could stay well ahead of the government.
In this case, it was the focus on Guam that particularly caught the attention of officials assessing China’s capabilities — and its readiness — to attack or smother Taiwan. President Xi Jinping has ordered the People’s Liberation Army to take the island by 2027. But CIA Director William J. Burns has remarked to Congress that the order “does not mean he has decided to launch an invasion.”
In the dozens of US tabletop exercises conducted over the past few years to map out what such an attack might look like, one of China’s first expected moves would be to cut off US communications and enhance the United States’ ability to to slow down. The exercises thus provide for attacks on satellite and ground communications, especially around US installations where military assets would be mobilized.
None are bigger than Guam, where Andersen Air Force Base would be the launching point for many of the Air Force’s missions to help defend the island, and a naval port is crucial for U.S. submarines.