China Is Strapping ‘Digital Bombs’ to Civilian Infrastructure—Is the US Ready?
China's Volt Typhoon group is pre-positioning malware in US critical infrastructure.
A war game simulating a Chinese cyberattack on US water utilities revealed the potential impact of Volt Typhoon's three-year pre-positioning campaign. This state-sponsored Chinese hacking group is planting malware within US critical infrastructure, aiming to disrupt essential services like water supply, power, and telecommunications, rather than focusing on espionage.
AI summary of the linked source. Not reviewed by an editor. How this works
The lesson from this incident
Full lessonChina's Volt Typhoon group has spent over three years quietly embedding malware inside US critical infrastructure—water, power, and telecom systems—not to steal data, but to pre-position for future disruptive attacks. This 'living-off-the-land' strategy exploits trusted system tools and poorly segmented operational technology (OT) networks, making detection extremely difficult. The threat is not theoretical: a recent war game demonstrated how these dormant implants could cripple essential services during a geopolitical crisis. The long dwell time highlights catastrophic failures in continuous monitoring and anomaly detection within critical infrastructure environments. If adversaries can sit undetected for years, defenders are already losing the battle before a single shot is fired.
What helps against this
How we list vendors
- Threat intelligence
Attack campaigns reach your sector, suppliers or software before your team hears about them.
- Network segmentation and microsegmentation
One compromised machine can no longer reach everything else.
- OT and industrial control system security
Factory, building and utility control systems get visibility and protection.