Briefing: Chinese Cyber Operations Against U.S. Infrastructure
Chinese officials indirectly acknowledge their involvement in cyberattacks
Overview
This week reports emerged about a meeting in which Chinese officials admitted through indirect statements to attacking U.S. infrastructure with cyberattacks because of Washington’s growing support for Taiwan. The "Volt Typhoon" campaign reflects a major increase in both China's cyber abilities and its strategic goals. This briefing examines the wider impacts of China's cyber operations through espionage efforts such as "Salt Typhoon" while stressing the geopolitical significance tied to the Taiwan dispute.
Key Developments
Tacit Admission by China:
In a closed-door Geneva summit in December 2024, Chinese officials indirectly admitted to orchestrating cyberattacks on U.S. infrastructure through the "Volt Typhoon" campaign. While their statements were ambiguous, U.S. officials interpreted them as confirmation of Beijing's role in these operations.
Volt Typhoon targeted critical infrastructure sectors, including ports, water utilities, airports, telecommunications networks, and even the electric grid. Hackers exploited zero-day vulnerabilities and used stealth techniques to infiltrate systems without detection.
In one alarming instance, Chinese operatives remained undetected within U.S. electric grid systems for 300 days in 2023—a sign of their advanced capabilities and strategic intent.
Link to Taiwan Policy:
During the Geneva talks, Wang Lei, a senior Chinese cyber official, suggested that these intrusions were retaliation for U.S. military backing of Taiwan.
Beijing views Taiwan as a core national interest and has increasingly signaled its readiness to escalate tensions over the island through both conventional and unconventional means.
The tacit acknowledgment was interpreted by U.S. officials as a warning: China demonstrated its ability to disrupt critical systems as leverage against further American involvement in Taiwan.
U.S. Reaction:
American officials stressed that prepositioning implants in civilian infrastructure is considered an act of war and conveyed doubts about whether China’s leadership fully understood the risks of such actions.
The Biden administration sought to highlight concerns that President Xi Jinping and other top leaders might not be fully aware of the activities conducted by Chinese hackers.
The Trump administration has since vowed to pursue more offensive cyber strategies against China while grappling with internal challenges such as cybersecurity workforce reductions and leadership changes at key agencies like the NSA.
Salt Typhoon Espionage Campaign:
In addition to Volt Typhoon, China has conducted another operation known as "Salt Typhoon," which infiltrated U.S. telecommunications networks such as AT&T and Verizon.
Salt Typhoon allowed Chinese hackers to spy on unencrypted communications of senior U.S. government officials and political figures, including those involved in presidential campaigns.
While raised during the Geneva meeting, Salt Typhoon was largely viewed as traditional espionage rather than an outright provocation like Volt Typhoon.
Geopolitical Implications:
The Geneva summit underscored growing hostilities between Washington and Beijing amid trade wars and military tensions over Taiwan’s future.
Experts view China's acknowledgment of its cyber capabilities as a strategic signal aimed at deterring U.S. intervention in a potential Taiwan conflict.
These developments highlight China's shift toward using cyber operations not just for espionage but as tools for coercion and disruption on a global scale.
Conclusion
The Geneva summit disclosures serve as a pivotal moment in U.S.-China relations by demonstrating Beijing's readiness to deploy cyber operations for strategic advantage over Washington. Volt Typhoon presents an immediate military danger to crucial systems while Salt Typhoon displays China's ability to conduct massive espionage operations. These cybersecurity operations demonstrate the complex connection between digital security threats and significant geopolitical disputes such as Taiwan's political situation. These attacks push the U.S. to enhance its cyber defenses against official state threats and brace for future digital conflicts on an unstable battlefield.
Source Material
In Secret Meeting, China Acknowledged Role in U.S. Infrastructure Hacks
PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure
Why didn't the WSJ include quotations of the exact statements by the Chinese officials?