FlagThis

Cyber experts are raising serious concerns about operational technology (OT) security after the Volt Typhoon threat group went undetected within the US electric grid for almost a year. This prolonged compromise, lasting over 300 days, marks the first known infiltration of the US electric grid by the Voltzite subgroup, linked to the Chinese APT Volt Typhoon. The attackers targeted critical OT infrastructure data, underscoring the persistent and sophisticated cyber espionage efforts aimed at US infrastructure.

The security breach, discovered in November 2023, involved the Littleton Electric Light and Water Department (LELWD) in Massachusetts. Investigations revealed that Volt Typhoon likely gained access to LELWD's IT environment in February 2023. During the attack the Chinese hackers sought specific data related to operational technology operating procedures and spatial layout data relating to energy grid operations, The incident led to LELWD expediting the deployment of its OT security solutions.

ImgSrc: cdn.mos.cms.fut

References :

• hackread.com: Chinese Volt Typhoon Hackers Infiltrated US Electric Utility for Nearly a Year
• PCMag UK security: Chinese Hackers Sat Undetected in Small Massachusetts Power Utility for Months
• www.itpro.com: Cybersecurity firm Dragos has revealed the Volt Typhoon threat group remained undetected in the US electric grid for nearly a year.
• www.scworld.com: US electric utility subjected to almost year-long Volt Typhoon compromise
• CyberInsider: Revealing the Volt Typhoon threat group's covert access to a Massachusetts electric utility network.
• bsky.app: Massachusetts Power Utility hacked by Chinese 'hackers' (cyber operators) for more than 300 days.
• : Volt Typhoon Accessed US OT Network for Nearly a Year
• Information Security Buzz: Volt Typhoon Found Inside Massachusetts Electric Utility for Nearly a Year
• Industrial Cyber: Dragos details the hacking of LELWD and the VOLTZITE group.
• Matthias Schulze: China’s Volt Typhoon Hackers Dwelled in US Electric Grid for 300 Days

Classification:

• HashTags: #VoltTyphoon #USElectricGrid #CyberAttack
• Company: US Electric Utility
• Target: US electric grid
• Attacker: Volt Typhoon
• Product: Electric Grid
• Feature: OT data exfiltration
• Type: Espionage
• Severity: Major