Plan ahead High Monitor
Explainer: China-linked Volt Typhoon found inside US power and water utilities
Nacionale (via Google News)energy, water
What happened. Nacionale explains Volt Typhoon, a China-linked hacking group. It reports the group has been found inside US power and water utilities.
Who is affected. US energy and water utilities, according to the report. The source does not name individual organisations.
What to do. No action is named. Share with your SOC or OT security team so they can check for the same indicators.
When to act. Plan ahead: Power and water operators: a China-linked group was found inside utilities; check remote access and control networks…
Editor's reading
ForOT security leaddetection engineerleadership
- Purdue level
- L4
- L3
Why: Being found inside utilities points to intrusions in corporate networks (L4) and the operations systems they connect to (L3).
- Are you exposed?
Review which accounts and remote-access paths link your corporate network to control networks, and check their logs for activity you cannot explain.
- If you cannot fix it yet
- Limit remote access into control networks to named users and require multi-factor authentication.
- Restrict connections from the corporate network into operations systems to approved jump hosts.
- Watch for
- Look for logons to operations servers or engineering workstations from the IT network that do not match normal patterns.
- Watch for new remote-access tools appearing on hosts that bridge IT and control networks.
Inferred from the facts above, not stated by the source. Check it against your own site before acting.
Source: Nacionale (via Google News) (opens news.google.com)
More on Energy and power Water and wastewater