For up to five years, in some cases, they were already inside. That is what U.S. incident responders concluded about Chinese state-sponsored actors sitting on American critical infrastructure networks — not stealing, not defacing, just holding access. Waiting. A series of U.S. government advisories has now dismantled, in public, the comforting assumption that the most important systems were safe because they were obscure, air-gapped, and hard to understand. For operational technology, the danger has moved past the hypothetical, and resilience has become the one word around which defenders are now rebuilding their playbook.
Pre-positioned, not spying
On February 7, 2024, CISA, the NSA and the FBI — joined by international partners — published a joint advisory on a Chinese state-sponsored hacking group known as Volt Typhoon. Catalogued as AA24-038A, the advisory confirmed the group had got inside the IT environments of several critical infrastructure organizations — most of them in communications, energy, transportation systems, and water and wastewater — in both the continental and non-continental United States, Guam included.
The intrusion itself was not what set this advisory apart; the judgment about intent was. "Volt Typhoon's choice of targets and pattern of behavior is not consistent with traditional cyber espionage or intelligence gathering operations," the agencies wrote, assessing with high confidence that the actors were pre-positioning on IT networks to enable lateral movement to OT assets and disrupt functions. Espionage steals information and leaves. Pre-positioning stays, maps the terrain, and waits for an order.
Microsoft's first public account of the campaign came in May 2023, and it put the actor's activity back to at least mid-2021. That long concealment followed from the group's tradecraft: Volt Typhoon works almost entirely by "living-off-the-land", leaning on tools already built into the operating system and on legitimate administrator credentials, instead of custom malware an antivirus product might catch. To mask their traffic, the operators routed it through compromised small office and home office routers — ordinary consumer gear chained into a covert relay network investigators tracked as the KV-botnet. In January 2024, the FBI, acting with court authorization, took control of the hijacked routers.
Living off the land is a detection problem as much as an intrusion technique. Defensive tooling is built to spot foreign code — malware with unfamiliar signatures doing unfamiliar things. An operator using the system's own administrative tools, with credentials that check out, generates activity that looks like Tuesday. Every element points the same way: the routers were other people's hardware, the tools were the victim's own, the credentials were legitimate. What was foreign was only the intent, and intent leaves no signature an antivirus can flag.
The dwell times were sobering. Andrew Scott, CISA's associate director for China operations, told an audience in 2024 that responders working incidents had confirmed Chinese cyber actors "on our critical infrastructure networks for in some cases up to the last five years," and he added: "They have the access that they need, and if the order was given, they could disrupt some services in this country right now." Two months later, FBI Director Christopher Wray warned at Vanderbilt University that China was developing "the ability to physically wreak havoc on our critical infrastructure at a time of its choosing," with a plan to "land blows against civilian infrastructure to try to induce panic," as reported by Reuters.
Salt Typhoon went for the backbone
While Volt Typhoon targeted the operators of physical infrastructure, a parallel Chinese campaign went after the networks everything depends on. Salt Typhoon — active since at least 2019, according to investigators — penetrated major U.S. telecom carriers. October 2024 reporting indicated AT&T, Verizon and Lumen had been breached, and that the intruders may have reached systems used for court-authorized law enforcement wiretaps. Read that again: the systems a government uses to listen, themselves listened to.
The campaign's scale became clearer through 2025: between December 2024 and January 2025, according to Recorded Future's Insikt Group, Salt Typhoon went after more than 1,000 Cisco network devices, with over half located in the United States, South America and India. Investigating the intrusions, Cisco Talos found the attackers had entered core networking infrastructure "primarily through stolen credentials," and said plainly: "No new Cisco vulnerabilities were discovered during this campaign." The hackers needed no zero-days, apart from one older flaw: with harvested passwords, they simply logged in and moved from router to router, in some cases for years.
Joint advisory AA25-239A, published in August 2025 by the NSA, CISA, the FBI and international partners, documented how telecom backbone routers had been compromised, with indicators of compromise plus mitigation guidance. CISA Director Jen Easterly had warned in January 2025 that the Salt Typhoon intrusions were likely "just the tip of the iceberg," and that foreign adversaries remained "relentlessly focused on holding our critical infrastructure at risk." Together, the two campaigns — and the harvest-now, decrypt-later espionage campaigns running alongside them — illustrate the modern state-sponsored playbook: patience measured in years, legitimate credentials instead of noisy malware, and positioning inside the networks that keep societies running.
The air gap is a layer, not a wall
Information technology and operational technology fail in fundamentally different ways. In an IT environment, a ransomware incident usually leaves files encrypted and systems down. A compromise in an OT environment — the supervisory control and data acquisition (SCADA) systems, programmable logic controllers and safety instrumented systems that run power plants, water treatment and manufacturing — can mean physical damage, environmental release, or loss of life. Iranian uranium-enrichment centrifuges were damaged by the 2010 Stuxnet worm, still the standard example of code breaking machines.
Historically, a mix of obscurity and isolation was what protected OT environments. Many industrial networks were designed decades ago, before connectivity was assumed, and operators relied on "air gaps" — physical separation of control networks from the internet — as a primary defense. But an air gap turns out to leak: maintenance laptops, USB drives, vendor remote access and IT/OT analytics links cross it as a matter of routine. And once that crossing happens, the flat legacy networks sitting behind it do not put up much resistance. An air gap that a technician's laptop crosses every week is not a moat. It is a door with a long hallway behind it.
So in modern OT security architecture, the air gap counts as a single layer, not the entire strategy. Under the widely used Purdue model, industrial networks are stacked in levels — physical processes at Level 0, then supervisory control, then enterprise IT — and between OT and IT sits a demilitarized zone where traffic gets inspected and restricted. Data diodes — hardware devices that enforce strictly one-way data flow — allow monitoring data out while making it physically impossible for traffic to flow back in. With segmentation in place, a compromise of corporate IT — just the kind Volt Typhoon pulled off — cannot pivot freely into the control network.
Visibility matters as well: the demand for watching systems without weighing them down shows up in the push toward lightweight eBPF probes for kernel-level monitoring, the same push reshaping cloud security, and the other half of the problem is handled by confidential computing that protects data even while it is in use. And because OT systems often cannot be patched on IT timelines — a turbine controller may run for years between maintenance windows — monitoring and allowlisting carry weight that patching alone cannot.
Resilience, written into law
Governments have begun converting these engineering principles into legal obligations. The European Union's NIS2 directive (Directive 2022/2555) sharply raised Europe's cybersecurity baseline, and member states were required to transpose it into national law by October 17, 2024. Where the original NIS directive covered a narrow set of operators, NIS2 spans 18 sectors — including energy, transport, water, health, digital infrastructure and manufacturing — and classifies covered organizations as "essential" or "important" entities.
The obligations are concrete: documented cybersecurity risk management, supply-chain security assessments, and incident reporting on a strict clock — an early warning within 24 hours of becoming aware of a significant incident, a full notification within 72 hours, and a final report within one month. Approving and overseeing the measures falls to management bodies, and personal accountability can follow for them. Fines reach €10 million or 2 percent of global turnover for essential entities. For industrial operators, practices like broker access control, audit logging and high availability — once internal best practices — have become legal duties.
For critical infrastructure operators, CISA's guidance keeps returning to the same set of practices. First, know what you have: keep an inventory of assets that covers OT devices and how they connect to the network, because what you cannot see, you cannot defend. Second, segment aggressively: getting from a compromised IT workstation to a safety controller should mean crossing monitored boundaries in succession, not moving across a single flat network. Third, monitor the OT network itself with tools that understand industrial protocols — anomalous commands to a controller look nothing like anomalous web traffic.
Fourth, make plans for the incident you hope will never happen: tabletop exercises with OT engineers alongside the IT security team surface the gaps that matter: who holds authority to isolate a control network, how long manual operation can keep a plant running, and which vendor contracts guarantee emergency response. And fifth, identity needs treating as the perimeter it now is: legitimate credentials were the way in for both Volt Typhoon and Salt Typhoon, and the fix is phishing-resistant multifactor authentication, privileged access management, and removing default and shared credentials from OT assets. The same long-horizon thinking drives the cryptographic migration now under way in the post-quantum TLS 1.3 roadmap built on ML-KEM-768.
That reframing — from prevention to resilience — is the thread connecting everything above. Relying on attackers finding you uninteresting belongs to a finished era. Patience and ample resources mark these intruders, and some of them are already inside. Resilience — detecting, containing, and recovering when prevention fails — is now the standard operators are judged by.
Sources
- CISA / NSA / FBI joint advisory on Volt Typhoon (AA24-038A, February 7, 2024) — release mirror
- StateScoop — "'We know they're on the network,' CISA official says of nation-state actors infiltrating U.S. critical infrastructure"
- SecurityAffairs — "China-linked APT Volt Typhoon remained undetected for years in US infrastructure" (February 8, 2024)
- Arctic Wolf — "Volt Typhoon Targets Critical Infrastructure Entities"
- CyberWarZone — "Volt Typhoon: China's Critical Infrastructure Pre-Positioning Campaign"
- Threadlinqs — Nation-state intrusions into telecom (Salt Typhoon timeline)
- CareersInfoSecurity — "CISA First Spotted Salt Typhoon Hackers in Federal Networks"
- Cybernoz — "Chinese Hackers Use Custom Malware To Spy On US Telecom Networks" (Cisco Talos findings)
- Wikipedia — NIS2 Directive (Directive (EU) 2022/2555)
- VibeDoctor — "NIS2 in Plain English"
