Chinese hackers hid in US infrastructure network for 5 years

Volt Typhoon, a PRC-linked advanced persistent threat, infiltrated and maintained undetected footholds in multiple U.S. critical infrastructure networks (communications, energy, transportation, water) for at least five years using living-off-the-land techniques, stolen credentials, and a SOHO-router botnet (KV-botnet); U.S. agencies (CISA, NSA, FBI and Five Eyes) warn the group seeks to pre-position access to OT systems for potential disruptive operations and have issued detection and mitigation guidance.