Chinese Hackers Operate Undetected in U.S. Critical Infrastructure for Half a Decade

U.S. agencies (CISA, NSA, FBI) and Five Eyes partners say the China-linked APT known as Volt Typhoon has maintained long-term, stealthy access in IT networks of U.S. and Guam critical infrastructure since at least 2021, using living-off-the-land tools, credential theft, targeted log deletion, and multi-hop proxy routing to pre-position for potential disruptive operations against OT environments; the advisory also notes a separate influence operation (PAPERWALL) tied to pro-Beijing content sites.