Microsoft reports attack by hackers in China on US infrastructure organizations

Microsoft reported Wednesday that alleged China-backed hackers have conducted a cyberattack on "critical infrastructure," raising concerns about potential disruptions to communications infrastructure.

"Microsoft has uncovered stealthy and targeted malicious activity focused on post-compromise credential access and network system discovery aimed at critical infrastructure organizations in the United States," it said in a statement.

The company said the attack was carried out by Volt Typhoon, which it said was a state-sponsored actor based in China that focuses on espionage and information gathering.

"Microsoft assesses with moderate confidence that this Volt Typhoon campaign is pursuing development of capabilities that could disrupt critical communications infrastructure between the United States and Asia region during future crises," it said.

Volt Typhoon has been active since mid-2021 and has targeted critical infrastructure organizations in Guam and elsewhere in the US, it said.

"In this campaign, the affected organizations span the communications, manufacturing, utility, transportation, construction, maritime, government, information technology, and education sectors.

"Observed behavior suggests that the threat actor intends to perform espionage and maintain access without being detected for as long as possible," said the statement.