U.S. assets in Guam and mainland U.S. hacked by China

In addition to the living-off-the-land approach, the hackers employed compromised home and small office routers as an intermediary infrastructure to conceal their activity. This enabled them to communicate with infected computers using local ISPs in the same geographical area.

"To achieve their objective, the threat actor puts a strong emphasis on stealth in this campaign, relying almost exclusively on living-off-the-land techniques and hands-on-keyboard activity. They issue commands via the command line to (1) collect data, including credentials from local and network systems, (2) put the data into an archive file to stage it for exfiltration, and then (3) use the stolen valid credentials to maintain persistence," explains Microsoft in the report.

"In addition, 'Volt Typhoon' tries to blend into normal network activity by routing traffic through compromised small office and home office (SOHO) network equipment, including routers, firewalls, and VPN hardware. They have also been observed using custom versions of open-source tools to establish a command and control (C2) channel over proxy to further stay under the radar," Microsoft adds.

According to Microsoft researchers, the purpose of the campaign is probably to enhance abilities for interfering with crucial communication infrastructure between the US and Asia region during potential crises. Guam, for example, holds significant value for the US military due to its Pacific ports and air base. With growing tensions surrounding Taiwan, Guam's strategic importance has garnered attention.

“Volt Typhoon proxies all its network traffic to its targets through compromised SOHO network edge devices (including routers),” Microsoft researchers explain. “Microsoft has confirmed that many of the devices, which include those manufactured by ASUS, Cisco, D-Link, NETGEAR, and Zyxel, allow the owner to expose HTTP or SSH management interfaces to the Internet,” they added.

Several industries have been impacted, including communications, manufacturing, utility, transportation, construction, maritime, government, information technology, and education. The advisories offer instructions on how to disinfect networks that have been compromised.