China's Cyberattackers Maneuver to Disrupt US Critical Infrastructure

CISA warns that the China-backed Volt Typhoon APT has maintained multi-year access to IT environments of US and allied critical infrastructure and is pivoting into OT/ICS networks; the group uses valid accounts and living-off-the-land techniques for stealthy, long-term persistence, posing a credible risk of disruptive physical effects on energy, water, communications, and transportation systems, while recent actions disrupted a SOHO router botnet the group used.