This week the Five Eyes alliance — an intelligence alliance between Australia, the United Kingdom, Canada, New Zealand and the United States — announced its investigation into a China-backed threat targeting US infrastructure.

Using stealth techniques, the attacker — referred to as “Volt Typhoon” — exploited existing resources in compromised networks in a technique called “living off the land”.

Microsoft made a concurrent announcement, stating the attackers’ targeting of Guam was telling of China’s plans to potentially disrupt critical communications infrastructure between the US and Asia region in the future.

• READ MORE: Deterring China isn’t all about submarines. Australia’s ‘cyber offence’ might be its most potent weapon

This comes hot on the heels of news in April of a North Korean supply chain attack on Asia-Pacific telecommunications provider 3CX. In this case, hackers gained access to an employee’s computer using a compromised desktop app for Windows and a compromised signed software installation package.

The Volt Typhoon announcement has led to a rare admission by the US National Security Agency that Australia and other Five Eyes partners are engaged in a targeted search and detection scheme to uncover China’s clandestine cyber operations.

Such public admissions from the Five Eyes alliance are few and far between. Behind the curtain, however, this network is persistently engaged in trying to take down foreign adversaries. And it’s no easy feat.

Let’s take a look at the events leading up to Volt Typhoon — and more broadly at how this secretive transnational alliance operates.

Uncovering Volt Typhoon
Volt Typhoon is an “advanced persistent threat group” that has been active since at least mid-2021. It’s believed to be sponsored by the Chinese government and is targeting critical infrastructure organisations in the US.

The group has focused much of its efforts on Guam. Located in the Western Pacific, this US island territory is home to a significant and growing US military presence, including the air force, a contingent of the marines, and the US navy’s nuclear-capable submarines.

It’s likely the Volt Typhoon attackers intended to gain access to networks connected to US critical infrastructure to disrupt communications, command and control systems, and maintain a persistent presence on the networks.

Volt Typhoon is the name Microsoft and the Five Eyes intelligence agencies have given a Chinese state sponsored hacking group, which they say installed a mysterious code in Guam’s telecommunications systems. https://t.co/xEwith7ZmM

— RN Breakfast (@RNBreakfast) May 25, 2023

The latter tactic would allow China to influence operations during a potential conflict in the South China Sea.

Australia wasn’t directly impacted by Volt Typhoon, according to official statements. Nevertheless, it would be a primary target for similar operations in the event of conflict.

As for how Volt Typhoon was caught, this hasn’t been disclosed. But Microsoft documents highlight previous observations of the threat actor attempting to dump credentials and stolen data from the victim organisation. It’s likely this led to the discovery of compromised networks and devices.

Living-off-the-land
The hackers initially gained access to networks through internet-facing Fortinet FortiGuard devices, such as routers. Once inside, they employed a technique called “living-off-the-land”.

This is when attackers rely on using the resources already contained within the exploited system, rather than bringing in external tools. For example, they will typically use applications such as PowerShell (a Microsoft management programme) and Windows Management Instrumentation to access data and network functions.

By using internal resources, attackers can bypass safeguards that alert organisations to unauthorised access to their networks. Since no malicious software is used, they appear as a legitimate user.

As such, living-off-the-land allows for lateral movement within the network, and provides opportunity for a persistent, long-term attack.

The simultaneous announcements from the Five Eyes partners points to the seriousness of the Volt Typhoon compromise. It will likely serve as a warning to other nations in the Asia-Pacific region.

Who are the Five Eyes?
Formed in 1955, the Five Eyes alliance is an intelligence-sharing partnership comprising Australia, Canada, New Zealand, the UK and the US.

The alliance was formed after World War II to counter the potential influence of the Soviet Union. It has a specific focus on signals intelligence. This involves intercepting and analysing signals such as radio, satellite and internet communications.

The members share information and access to their respective signals intelligence agencies, and collaborate to collect and analyse vast amounts of global communications data. A Five Eyes operation might also include intelligence provided by non-member nations and the private sector.

Recently, the member countries expressed concern about China’s de facto military control over the South China Sea, its suppression of democracy in Hong Kong, and threatening moves towards Taiwan.

The latest public announcement of China’s cyber operations no doubt serves as a warning that Western nations are paying strict attention to their critical infrastructure — and can respond to China’s digital aggression.

In 2019, Australia was targeted by Chinese state-backed threat actors gaining unauthorised access to Parliament House’s computer network. Indeed, there is evidence that China is engaged in a concerted effort to target Australia’s public and private networks.

The Five Eyes alliance may well be one of the only deterrents we have against long-term, persistent attacks against our critical infrastructure.

Dennis B. Desmond is a lecturer, Cyberintelligence and Cybercrime Investigations, University of the Sunshine Coast. This article is republished from The Conversation under a Creative Commons licence. Read the original article.

The multi-country condemnation of cyber-attacks by Chinese state-sponsored agencies is a sign of increasing frustration at recent behaviour. But it also masks the real problem — international law isn’t strong or coherent enough to deal with this growing threat.

The coordinated announcement by several countries, including the US, UK, Australia and New Zealand, echoes the most recent threat assessment from the US intelligence community: cyber threats from nation states and their surrogates will remain acute for the foreseeable future.

Joining the chorus against China may be diplomatically risky for New Zealand and others, and China has already described the claims as “groundless and irresponsible”. But there is no doubt the problem is real.

• READ MORE: With cyberattacks growing more frequent and disruptive, a unified approach is essential
• Improving cybersecurity means understanding how cyberattacks affect both governments and civilians
• Ransomware, data breach, cyberattack: What do they have to do with your personal information, and how worried should you be?
  
• Cyber Cold War? The US and Russia talk tough, but only diplomacy will ease the threat

The latest report from New Zealand’s Government Communications Security Bureau (GCSB) recorded 353 cyber security incidents in the 12 months to the middle of 2020, compared with 339 incidents in the previous year.

Given the focus is on potentially high-impact events targeting organisations of national significance, this is likely only a small proportion of the total. But the GCSB estimated state-sponsored attacks accounted for up to 30 percent of incidents recorded in 2019-20.

Since that report, more serious incidents have occurred, including attacks on the stock-exchange and Waikato hospital. The attacks are becoming more sophisticated and inflicting greater damage.

Globally, there are warnings that a major cyberattack could be as deadly as a weapon of mass destruction. The need to de-escalate is urgent.

Global solutions missing
New Zealand would be relatively well-prepared to cope with domestic incidents using criminal, privacy and even harmful digital communications laws. But most cybercrime originates overseas, and global solutions don’t really exist.

The government says it has uncovered evidence of Chinese state-sponsored cyber attacks in New Zealand.https://t.co/wB5Q8M4lwO

— RNZ (@radionz) July 19, 2021

In theory, the attacks can be divided into two types — those by criminals and those by foreign governments. In reality, the line between the two is blurred.

Dealing with foreign criminals is slightly easier than combating attacks by other governments, and Prime Minister Jacinda Ardern has recognised the need for a global effort to fight this kind of cybercrime.

To that end, the government recently announced New Zealand was joining the Council of Europe’s Convention on Cybercrime, a global regime signed by 66 countries based on shared basic legal standards, mutual assistance and extradition rules.

Unfortunately, some of the countries most often suspected of allowing international cybercrime to be committed from within their borders have not signed, meaning they are not bound by its obligations.

That includes Russia, China and North Korea. Along with several other countries not known for their tolerance of an open, free and secure internet, they are trying to create an alternative international cybercrime regime, now entering a drafting process through the United Nations.

‘Groundless, irresponsible’: China fires back at NZ after cyber attack accusation https://t.co/oGSOMtFdXT

— Newshub Politics (@NewshubPolitics) July 19, 2021

Cyberattacks as acts of war
Dealing with attacks by other governments (as opposed to criminals) is even harder.

Only broad principles exist, including that countries refrain from the threat or use of force against the territorial integrity or political independence of any state, and that they should behave in a friendly way towards one another. If one is attacked, it has an inherent right of self-defence.

Malicious state-sponsored cyber activity involving espionage, ransoms or breaches of privacy might qualify as unfriendly and in bad faith, but they are not acts of war.

However, cyberattacks directed by other governments could amount to acts of war if they cause death, serious injury or significant damage to the targeted state. Cyberattacks that meddle in foreign elections may, depending on their impact, dangerously undermine peace.

And yet, despite these extreme risks, there is no international convention governing state-based cyberattacks in the ways the Geneva Conventions cover the rules of warfare or arms control conventions limit weapons of mass destruction.

Risks of retaliation
The latest condemnation of Chinese-linked cyberattacks notwithstanding, the problem is not going away.

At their recent meeting in Geneva, US President Joe Biden told his Russian counterpart, Vladimir Putin, the US would retaliate against any attacks on its critical infrastructure. A new US agency aimed at countering ransomware attacks would respond in “unseen and seen ways”, according to the administration.

Such responses would be legal under international law if there were no alternative means of resolution or reparation, and could be argued to be necessary and proportionate.

Also, the response can be unilateral or collective, meaning the US might call on its friends and allies to help. New Zealand has said it is open to the proposition that victim states can, in limited circumstances, request assistance from other states to apply proportionate countermeasures against someone acting in breach of international law.

A drift towards lawlessness
But only a month after Biden drew his red line with Putin, another massive ransomware attack crippled hundreds of service providers across 17 countries, including New Zealand schools and kindergartens.

The Russian-affiliated ransomware group REvil that was probably behind the attacks mysteriously disappeared from the internet a few weeks later.

Things are moving fast and none of it is very reassuring. In an interconnected world facing a growing threat from cyberattacks, we appear to be drifting away from order, stability and safety and towards the darkness of increasing lawlessness.

The coordinated condemnation of China by New Zealand and others has considerably upped the ante. All parties should now be seeking a rules-based international solution or the risk will only grow.

Dr Alexander Gillespie is professor of law, University of Waikato. This article is republished from The Conversation under a Creative Commons licence. Read the original article.

New Zealand’s cyber security agency believes China has been behind numerous hack attacks spanning years.

The government joined Western allies and Japan in calling out Beijing for so-called state-sponsored hacks, including a major incursion in February when Microsoft email servers were targeted.

The US has charged four Chinese nationals — three security officials and one contract hacker — with targeting dozens of companies and government agencies in the United States and overseas under the cover of a tech company.

• WATCH RNZ CHECKPOINT LIVESTREAM: ‘This is obviously a real concern’ (Duration 7′:39″)
• READ MORE: NZ’s statement on China a shot across the bow – Geoffrey Miller
• NZ government points finger at China over cyber attacks

“What we do is when we see malicious cyber activity on New Zealand networks, that may be through our own capabilities that we have to help protect New Zealand networks or it may be something that’s reported to us, we look at the malware that’s used,” Government Communications Security Bureau Director-General Andrew Hampton told RNZ Checkpoint.

“We look at how the actor behaves. We look at who they might be targeting and what they do if they get onto a network.

“That allows us to build a bit of a picture of who the actor is. We then compare that with information that we receive, often from our intelligence partners who are also observing such activity.

“That allows us to make an assessment, and it’s always a probability assessment about who the actor is.

The APT 40 group
“In this case, because of the amount of information we’ve been able to access both from our own capabilities and from our partners, we’ve got a reasonably high level of confidence that the actor who we’ve seen undertaking this campaign over a number of years, and in particular, who was responsible for the Microsoft Exchange compromise, was the APT 40 group — Advanced Persistent Threat Group 40 — which has been identified as associated with the Chinese Ministry of State Security.

“The actors here are state sponsored actors rather than what we would normally define as a criminal group. What we’re seeing here is a state sponsored actor likely to be motivated by a desire to steal information.”

Hampton said there was a blurring of lines between what a state agency does, and what a criminal group does.

“Some of the technical capabilities that previously only state organisations had, have now got into the hands of criminal groups.

“Also what we’ve seen in a range of countries is individuals who may work part-time in a government intelligence agency, and then may work part-time in a criminal enterprise. Or they may have previously worked in a state intelligence agency and are now out by themselves but still have links links back to the state.

“We don’t know the full detail of the nature of the relationship, but what we do know is the Ministry of State Security in China, for example, is a very large organisation with many thousands of of employees.

“So they are big organisations with people on their payroll but they also would have connections with other individuals and organisations.

Information shared with criminals
“Something else worth noting with regard to this most recent compromise involving the Microsoft Exchange, what we saw there is once the Ministry of State Security actors had identified the vulnerability and exploited it, they then shared that information with a range of other actors, including criminal groups, so they too could exploit it.

“This is obviously a real concern to see this type of behaviour occurring,” Hampton said.

All evidence showed the cyber attacks were all originating from mainland China, Hampton told Checkpoint.

He said such attacks would be aimed at stealing data or possibly positioning themselves on a system to be able to access information in the future.

“A common tactic we see, unfortunately, is there may be a vulnerability in a system,” Hampton said.

“It could be a generic vulnerability across all users of that particular system, and a malicious actor may become aware of that vulnerability, so they would use that to get onto the network.

“That doesn’t mean they will then start exfiltrating data from day one or something like that. They may just want to to sit there in the event that at some point in the future they may want to start doing that.

Malicious actors
“This exploitation of known vulnerabilities is a real concern. This is why all organisations need to keep their security patches up to date, because what can happen is you can have malicious actors use technology to scan whole countries to see who hasn’t updated their patches.

“They then use that vulnerability to get on the network and they may not do anything with it for some time. Or they might produce a list of all the organisations, say, in New Zealand who haven’t updated their patches.

“Then they make a decision – okay these are the four to five we want to further exploit.”

This article is republished under a community partnership agreement with RNZ.

Websites belonging to the Republic of Fiji Military Force (RFMF), Fiji Police Force and the Immigration Department were today “defaced” apparently by a Kurdish hacker known for his anti-ISIS views. 

In the attack, MuhmadEmad uploaded a picture of the Kurdish flag along with the words, “KurDish HaCkerS WaS Here” and “HaCKeD by MuhmadEmad, Long Live to peshmarga.” This was a reference to the Kurdish army of Peshmerga, which has been fighting to defend its homeland from the so-called Islamic State force based in Iraq.

Fiji police spokesperson Inspector Josaia Weicavu said the force was aware of the hack and was working to rectify it.

An RFMF spokesperson was unaware of the incident when contacted, but said he would look into the issue.

Director of Immigration Nemani Vuniwaqa also said he was unaware of the hack, but would look into it urgently.

MuhmadEmad has reportedly hacked numerous US and Turkey government websites over the past two years.

Website “defacement”:

Website defacement is an attack on a website that changes the visual appearance of the site or a webpage. These are typically the work of system crackers, who break into a web server and replace the hosted website with one of their own.

The aftermath – six hours later – on Café Pacific

Hacking horrors in Fiji