Chinese Hacking Group ‘Volt Typhoon’ Exploits Software Bug to Compromise U.S. and International Internet Companies

A cybersecurity firm reported on Tuesday that a Chinese hacking group leveraged a software bug to breach several internet companies in the U.S. and internationally.

Lumen’s researchers reported in a blog post that the hackers found a previously unknown flaw in Versa Director, a software platform from Santa Clara, California-based Versa Networks. This platform is used to manage services for customers. Lumen identified four U.S. companies and one non-U.S. company as victims of the attack but did not name them. When asked for more details, Lumen did not respond immediately.

Versa Networks issued a warning on Monday, confirming that the vulnerability had been used “in at least one known instance” by a sophisticated group of hackers. The company urged customers to update their software to fix the bug.

Lumen’s researchers believe with “moderate confidence” that the hacking was done by a Chinese government-backed group known as “Volt Typhoon.” The attacks reportedly started as early as June 12. The Chinese Embassy in Washington did not respond to requests for comment, and Beijing usually denies involvement in cyber espionage. U.S. officials also did not immediately comment, but on Friday, the U.S. Cybersecurity and Infrastructure Security Agency added the Versa vulnerability to its list of “known exploited vulnerabilities.”

Brandon Wales, the former executive director of CISA, mentioned in the Washington Post that China‘s hacking efforts have “dramatically stepped up from where it used to be.” Volt Typhoon has become a major concern for U.S. cybersecurity officials. In April, FBI Director Christopher Wray warned that China is developing the “ability to physically wreak havoc” on critical U.S. infrastructure and that Volt Typhoon had infiltrated several U.S. telecommunications, energy, water, and other critical service companies.