Has China stolen another American defense secret after the F-35 as Salt Typhoon hacks US National Guard for a year?

Time of India

2 days ago

China faces scrutiny over cyber espionage. A US state's Army National Guard network suffered a breach. The group Salt Typhoon is suspected. Maps and data were stolen. The breach occurred between March and December 2024. Concerns rise about critical infrastructure vulnerability. Beijing denies involvement. The incident raises alarms about cybersecurity.
Tired of too many ads?
Remove Ads
Tired of too many ads?
Remove Ads
What is Salt Typhoon
Tired of too many ads?
Remove Ads
How China allegedly stole F-35 technology for Chengdu J-20
China is once again under scrutiny for cyber espionage, just a year after being accused of stealing F-35 stealth fighter technology through cyber breaches to build its Chengdu J-20. The latest breach surfaced after a Department of Homeland Security memo revealed that a US state's Army National Guard network was thoroughly hacked by a Chinese cyberespionage group nicknamed " Salt Typhoon ."The memo obtained by Property of the People, a national security transparency nonprofit, said the hackers "extensively compromised" the unnamed state Army National Guard's network between March and December 2024 and exfiltrated maps and "data traffic" with counterparts' networks in "every other US state and at least four US territories."The National Guard and the Department of Homeland Security's cyber defense arm, CISA, did not immediately return messages. News of the memo was first reported by NBC News.Salt Typhoon has emerged as one of the top concerns of American cyber defenders. US officials allege that the hacking group is doing more than just gathering intelligence; it is positioning itself to paralyze US critical infrastructure in the case of a conflict with China. Beijing has repeatedly denied being behind the intrusions.The memo, which said it drew on reporting from the Pentagon, said that Salt Typhoon's success in compromising states' Army National Guard networks nationwide "could undermine local cybersecurity efforts to protect critical infrastructure," in part because such units are often "integrated with state fusion centers responsible for sharing threat information, including cyber threats."According to the internal document obtained by NBC through the national security transparency nonprofit Property of the People via a Freedom of Information Act (FOIA) request, Salt Typhoon compromised the National Guard, which "likely provided crucial data to Beijing that could facilitate the hacking of other states' Army National Guard units and possibly many of their state-level cybersecurity partners.""If the PRC-associated cyber actors that conducted the hack succeeded in the latter, it could hamstring state-level cybersecurity partners' ability to defend US critical infrastructure against PRC cyber campaigns in the event of a crisis or conflict," the document stated.The document further revealed that the yearlong attack, which involved the compromise of a US state Army National Guard's network, collected network configuration and data traffic, as well as "its counterparts' networks in every other US state and at least four US territories, according to a Department of Defense (DOD) report." The breach also included network diagrams and administrator credentials.The scope of the attack could be beyond bespoke networks into state cyber-defense posture and personal information belonging to state cybersecurity personnel. "Salt Typhoon's success in compromising states' Army National Guard networks nationwide could undermine local cybersecurity efforts to protect critical infrastructure," the document read.'In some 14 states, Army National Guard units are integrated with state fusion centers responsible for sharing threat information, including cyber threats. In at least one state, the local Army National Guard unit directly provides network defense services," it further stated.Salt Typhoon, an advanced persistent threat (APT) linked to the Chinese government, breached the National Guard. The Department of Homeland Security (DHS) documents have revealed that Salt Typhoon is a high-profile cyber-espionage group that has targeted a wide range of victims, mainly in the telecommunications space.The group was found to have breached a number of major telco vendors, such as Verizon, T-Mobile, and AT&T, predominantly through a Cisco vulnerability."In -, Salt Typhoon used its access to a US state's Army National Guard network to exfiltrate administrator credentials, network traffic diagrams, a map of geographic locations throughout the state, and PII of its service members, according to DOD reporting," the document revealed.The Chinese Chengdu J-20 is suspected of using stolen F-35 technology after cyber breaches hit Lockheed Martin and an Australian defense contractor. The J-20's Electro-Optical Targeting System looks similar to the F-35's, raising concerns that advanced sensor tech was compromised.Introduced in 2017, the J-20 features airborne early warning and standoff missile launch and now uses a homegrown WS-15 engine that lets it reach speeds near Mach 2. These incidents show why F-35 subcontractors need strong cybersecurity, as some believe parts of the fighter's design were taken during at least one cyber breach.