Priya PatelVolt Typhoon, a Chinese government-sponsored cyberespionage group, has successfully breached the emergency network of a major US city, according to a report by industrial cybersecurity firm Dragos. The group has been conducting reconnaissance activities against multiple American electric companies since early 2023 and has recently expanded its targeting to include emergency management and telecommunications services. The report highlights that the group specifically selects strategic targets that would be valuable to an adversary seeking to cripple US infrastructure. The pace of Volt Typhoon’s penetration is said to be increasing, raising concerns about the vulnerability of critical infrastructure. The group also targeted electric transmission and distribution organisations in Africa.
Potential consequences of a breach by Volt Typhoon include disruption of emergency services, telecommunications and the power grid. The report notes that the group has primarily conducted reconnaissance and data exfiltration and has not been able to infiltrate the operational technology networks that control critical systems. However, they have stolen geographic information systems (GIS) data, which could be used in future disruptive attacks. Dragos has identified a range of devices and software that have been compromised by the group, including Fortinet FortiGuard, PRTG Network Monitor appliances, ManageEngine ADSelfService Plus, and Cisco ASA.
The findings of the report highlight the increasing risks posed by state-sponsored cyber espionage groups, particularly those targeting critical infrastructure. The breach of a US city’s emergency network raises concerns about the potential impact on public safety and highlights the need for enhanced cybersecurity measures to protect vital infrastructure.
