PRC cyber actor targeting US critical infrastructure – guidance to assist detection

The activity has been observed affecting networks across critical infrastructure sectors in the United States. The techniques described could also be used to impact other sectors and regions. 

One of the actor’s primary tactics, techniques, and procedures (TTPs) is living off the land, which uses a system’s built-in network administration tools to achieve malicious objectives while avoiding detection. 

This advisory is intended to help New Zealand critical infrastructure operators and cyber defenders detect this activity. Organisations should review the TTPs described to assess potential exposure.  

The NCSC is using its own cyber defence resources, including its Malware Free Networks capability, to support efforts to detect and disrupt this activity.

 If an organisation identifies malicious activity after reviewing this advisory, they should contact the National Cyber Security Centre.