[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fBN_hi0nNmv90HkoAuFxBDPx-TgXdeWf2sOm6lwkv3Zw":3},{"article":4,"iocs":46,"watch_terms":47,"solutions":48,"lesson":143},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"7052a026-4d23-4ed2-b878-0bc9140dff65","China Is Strapping ‘Digital Bombs’ to Civilian Infrastructure—Is the US Ready?","china-is-strapping-digital-bombs-to-civilian-infrastructure-is-the-us-ready-768dc1","This week on “Uncanny Valley,” Andy Greenberg discusses sitting in on a war game simulating a cyberattack from the Chinese hacking group Volt Typhoon","A war game simulating a Chinese cyberattack on US water utilities revealed the potential impact of Volt Typhoon's three-year pre-positioning campaign. This state-sponsored Chinese hacking group is planting malware within US critical infrastructure, aiming to disrupt essential services like water supply, power, and telecommunications, rather than focusing on espionage.","China's Volt Typhoon group is pre-positioning malware in US critical infrastructure.","https:\u002F\u002Fwww.wired.com\u002Fstory\u002Fchina-is-strapping-digital-bombs-to-civilian-infrastructure-is-the-us-ready\u002F","https:\u002F\u002Fmedia.wired.com\u002Fphotos\u002F6a861888d3fed06f8e21101b\u002Fmaster\u002Fpass\u002FUncanny-Valley-Podcast-Typhoon-Hack-Security-1130970903.jpg","2026-08-20T20:03:13+00:00","2026-08-20T22:00:13.146251+00:00",8,[17,20],{"name":18,"type":19},"Volt Typhoon","threat_actor",{"name":21,"type":22},"malware","technology","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":23,"icon":25,"name":26,"slug":27},null,"Nation-state","nation-state",[29,34,36,41],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":35},{"id":23,"icon":25,"name":26,"slug":27},{"category":37},{"id":38,"icon":25,"name":39,"slug":40},"d6f63bb8-0801-486a-be7f-171400700454","IoT\u002FOT","iot-ot",{"category":42},{"id":43,"icon":25,"name":44,"slug":45},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[],{"controls":49,"vendors":136},[50,78,107],{"slug":45,"name":51,"problem":52,"products":53},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[54,62,70],{"vendor_slug":55,"vendor_name":56,"vendor_logo":57,"product_slug":58,"product_name":59,"url":60,"description":61},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter-digital-risk-protection","GreyMatter Digital Risk Protection","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002Fdark-web-and-digital-risk-protection\u002F","Watches the open, deep and dark web for threats aimed at an organisation and alerts its security team in real time.",{"slug":79,"name":80,"problem":81,"products":82},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",[83,91,99],{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"illumio","Illumio","\u002Fvendor-logos\u002Fillumio.png","illumio-segmentation","Illumio Segmentation","https:\u002F\u002Fwww.illumio.com\u002Fillumio-segmentation","Maps traffic between workloads and enforces segmentation across data centre, cloud and endpoints.",{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"akamai","Akamai","\u002Fvendor-logos\u002Fakamai.png","guardicore-segmentation","Akamai Guardicore Segmentation","https:\u002F\u002Fwww.akamai.com\u002Fproducts\u002Fakamai-guardicore-segmentation","Software-based microsegmentation with traffic visibility.",{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","zero-trust-endpoint-firewall","Zero Trust Endpoint Firewall","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fzero-trust-endpoint-firewall","Centrally managed host firewall with device-level and dynamic access rules, to limit which machines can talk to each other.",{"slug":108,"name":109,"problem":110,"products":111},"ot-security","OT and industrial control system security","Factory, building and utility control systems get visibility and protection.",[112,120,128],{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-ot-security","Tenable OT Security","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fot-security","Asset inventory, vulnerability and threat detection for industrial networks.",{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":124,"product_name":125,"url":126,"description":127},"claroty","Claroty","\u002Fvendor-logos\u002Fclaroty.png","xdome","Claroty xDome","https:\u002F\u002Fclaroty.com\u002Findustrial-cybersecurity\u002Fxdome","Asset inventory, vulnerability management and threat detection for industrial networks.",{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"dragos","Dragos","\u002Fvendor-logos\u002Fdragos.png","dragos-platform","Dragos Platform","https:\u002F\u002Fwww.dragos.com\u002Fcybersecurity-platform\u002F","OT asset visibility, threat detection and response guidance for industrial environments.",[137],{"slug":138,"name":139,"logo_path":140,"roles":141},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png",[142],"reported_by",{"slug":144,"title":145,"body":146,"framework_refs":147,"framework_notes":158},"volt-typhoons-silent-infiltration-of-us-critical-infrastructure","Volt Typhoon's Silent Infiltration of US Critical Infrastructure","China's Volt Typhoon group has spent over three years quietly embedding malware inside US critical infrastructure—water, power, and telecom systems—not to steal data, but to pre-position for future disruptive attacks. This 'living-off-the-land' strategy exploits trusted system tools and poorly segmented operational technology (OT) networks, making detection extremely difficult. The threat is not theoretical: a recent war game demonstrated how these dormant implants could cripple essential services during a geopolitical crisis. The long dwell time highlights catastrophic failures in continuous monitoring and anomaly detection within critical infrastructure environments. If adversaries can sit undetected for years, defenders are already losing the battle before a single shot is fired.",[148,149,150,151,152,153,154,155,156,157],"NIST CSF 2.0 – DE.CM (Continuous Monitoring)","NIST SP 800-82 Rev 3 – ICS\u002FOT Security Guide","CIS Control 12 – Network Infrastructure Management","CIS Control 13 – Network Monitoring and Defense","CIS Control 17 – Incident Response Management","NERC CIP-005 – Electronic Security Perimeters","NERC CIP-007 – Systems Security Management","CISA Advisory AA24-038A – Volt Typhoon TTPs","NIST SP 800-137 – Continuous Monitoring","ICS-CERT Recommended Practices – Defense-in-Depth for OT",{}]