Officials from the National Security Agency (NSA) and the State Department admit they are facing challenges in developing effective deterrence strategies against the powerful hacking group known as Volt Typhoon, which is allegedly supported by the Chinese government and suspected of infiltrating US critical infrastructure networks.
During an Intelligence and National Security Summit this week, David Frederick, assistant deputy director for China at the NSA, acknowledged the difficulty in formulating a response to deter the group’s activities. „I don’t have a good answer to that,” he stated, highlighting the challenges posed by Volt Typhoon’s intentions to gain an asymmetric advantage in potential crises or conflicts. He elaborated that given the broad scope of their targets within the US and allied nations, the group is unlikely to be motivated to cease its operations. „It’s a hard problem—how do we get them, sort of thing,” Frederick added, expressing the complexities of the situation.
Liesyl Franz, the deputy assistant secretary for international cyberspace security at the State Department, echoed Frederick’s uncertainty when asked about deterrence strategies. „I don’t know the answer to that question either, but there are many key parts we’re trying to get at,” she said.
Franz noted that the State Department has intensified efforts to implement deterrence tactics, such as public attribution, which is a key component of the government’s strategy to name and shame state actors engaged in cyberattacks. „Once there has been adequate technical attribution and sufficient confidence, we publicly attribute those actions to hold state actors accountable,” she explained. However, she acknowledged that these measures have not significantly slowed the group’s activities.
Efforts by US officials to directly address China regarding its cyber operations have met with denial. Nathaniel Fick, the US ambassador at large for cyberspace, pointed out that Beijing dismisses the allegations as unfounded, framing them instead as a strategy by the US to secure additional funding for its own cybersecurity initiatives.
Volt Typhoon, which the US government characterizes as “sponsored” by the Chinese state, has reportedly compromised thousands of devices worldwide since its detection in 2021. The group gained more notoriety in May 2023 when Microsoft security analysts publicly identified it. On the same day Microsoft disclosed Volt Typhoon’s existence, the NSA and international agencies issued warnings about state-sponsored Chinese cyber actors targeting US critical infrastructure, most notably in Guam.
Earlier this year, the FBI and other agencies announced that Volt Typhoon had successfully infiltrated the IT environments of multiple critical infrastructure entities in the US, expressing concerns that these actions could lead to further disruptions if tensions escalate in the Indo-Pacific region, particularly regarding Taiwan.
Frederick emphasized that unlike traditional cyber espionage campaigns, Volt Typhoon’s operations are not focused on stealing information. Instead, they appear aimed at pre-positioning for future conflicts. „Xi Jinping views the US as a significant obstacle to his national rejuvenation and growth goals,” he explained. The Chinese government is intent on building military capabilities to deter US involvement in possible conflicts in the Pacific.
Describing the broader context of China’s strategy, he noted that the Volt Typhoon operations targeting infrastructure fit into a larger military strategy aimed at deterring and defeating US capabilities in potential conflict scenarios.
As of this week, cybersecurity researchers accused Volt Typhoon of exploiting a zero-day vulnerability in the network management platform Versa Director, attempting to infiltrate tech companies and internet service providers in the US. Reports indicate that the group discovered a flaw within Versa Director that allowed them to capture login credentials and execute harmful code on compromised servers without detection. Versa has since announced that the security vulnerability has been addressed.
