Digital threats from East Asia increase in breadth and effectiveness

Chinese state-affiliated threat actors show continued interest in the South China Sea and Taiwan, which reflects China’s wide range of economic, defense, and political interests in this region.¹ Conflicting territorial claims, rising cross-Strait tensions, and an increased US military presence may all be motivations for China’s offensive cyber activities.²

Microsoft has tracked Raspberry Typhoon (RADIUM) as the primary threat group targeting nations that ring the South China Sea. Raspberry Typhoon consistently targets government ministries, military entities, and corporate entities connected to critical infrastructure, particularly telecoms. Since January 2023, Raspberry Typhoon has been particularly persistent. When targeting government ministries or infrastructure, Raspberry Typhoon typically conducts intelligence collection and malware execution. In many countries, targets vary from defense and intelligence-related ministries to economic and trade-related ministries.

Flax Typhoon (Storm-0919) is the most prominent threat group targeting the island of Taiwan. This group primarily targets telecommunications, education, information technology, and energy infrastructure, typically by leveraging a custom VPN appliance to directly establish a presence within the target network. Similarly, Charcoal Typhoon (CHROMIUM) targets Taiwanese education institutions, energy infrastructure, and high-tech manufacturing. In 2023, both Charcoal Typhoon and Flax Typhoon targeted Taiwanese aerospace entities that contract with the Taiwanese military.

Multiple China-based threat groups continue to target the US defense industrial base, namely Circle Typhoon (DEV-0322), Volt Typhoon (DEV-0391), and Mulberry Typhoon (MANGANESE). While the targets of these three groups occasionally overlap, they are distinct actors with different infrastructure and capabilities.³

Circle Typhoon conducts a wide range of cyber activity against the US defense industrial base including resource development, collection, initial access, and credential access. Circle Typhoon often leverages VPN appliances to target IT and US-based defense contractors. Volt Typhoon has also conducted reconnaissance against numerous US defense contractors. Guam is one of the most frequent targets of these campaigns, particularly the satellite communications and telecommunications entities housed there.⁴

A frequent tactic of Volt Typhoon involves compromising small office and home routers, typically for the purpose of building infrastructure.⁵ Mulberry Typhoon has also targeted the US defense industrial base, most notably with a zero-day exploit targeting devices.⁶ Increased targeting of Guam is significant given its position as the closest US territory to East Asia and crucial to US strategy in the region.

Microsoft has observed Chinese state-affiliated threat groups targeting US critical infrastructure across multiple sectors and significant resource development over the last six months. Volt Typhoon has been the primary group behind this activity since at least the summer of 2021, and the extent of this activity is still not fully known.

Targeted sectors include transportation (such as ports and rail), utilities (such as energy and water treatment), medical infrastructure (including hospitals), and telecommunications infrastructure (including satellite communications and fiber optic systems). Microsoft assesses that this campaign could provide China with capabilities to disrupt critical infrastructure and communications between the United States and Asia.⁷

Beginning May 15, Storm-0558, a China-based threat actor, used forged authentication tokens to access Microsoft customer email accounts of approximately 25 organizations, including US and European government entities.⁸ Microsoft has successfully blocked this campaign. The objective of the attack was to obtain unauthorized access to email accounts. Microsoft assesses this activity was consistent with Storm-0558’s espionage objectives. Storm-0558 has previously targeted US and European diplomatic entities.

First, operations making use of video and visual media are becoming the norm. CCP-affiliated networks have long utilized AI-generated profile pictures, and this year have adopted AI-generated art for visual memes. State-backed actors will also continue to tap private content studios and public relations firms to outsource propaganda on demand.³⁵

Second, China will continue to seek authentic audience engagement, investing time and resources into cultivated social media assets. Influencers with deep cultural and linguistic knowledge and high-quality video content have been pioneers for successful social media engagement. The CCP will apply some of these tactics, including interacting with social media users and demonstrating cultural know-how, to bolster its covert social media campaigns.

Third, Taiwan and the United States are likely to remain the top two priorities for Chinese IO, particularly with upcoming elections in both countries in 2024. Given that CCP-aligned influence actors have targeted US elections in the recent past, it is nearly certain that they will do so again. Social media assets impersonating US voters will likely demonstrate higher degrees of sophistication, actively sowing discord along racial, socioeconomic, and ideological lines with content that is fiercely critical of the United States.