Advisory details shifting tactics of Chinese cyber actors using covert networks for malicious activity

A joint advisory released April 23 from U.S. and international cybersecurity agencies, including the Cybersecurity and Infrastructure Security Agency, FBI, National Security Agency and other global partners, warns that China-nexus cyber actors have significantly shifted their tactics, now posing heightened risks for hospitals and health systems that rely on connected devices and complex networks. According to the advisory, Chinese state-aligned threat actors are increasingly using large-scale “covert networks” of compromised devices to hide and route malicious activity. These networks, often composed of vulnerable small-office or home-office routers, Internet of Things devices and other edge hardware, enable attackers to disguise their origins, evade traditional defenses and operate at a massive scale. 

“For hospitals, this is particularly relevant. Health systems are considered critical infrastructure and have been exposed to China-affiliated malware campaigns such as Volt Typhoon and Flax Typhoon. These ‘Typhoon’ campaigns have used covert networks to conduct espionage and pre-position for disruptive attacks against other health care dependent critical infrastructure,” said John Riggi, AHA national security advisor for cybersecurity and risk. “Many of the compromised devices involved are ‘end-of-life’ technologies that no longer receive security updates, which can be commonly found in health care environments. Health systems should review their inventories for outdated or unpatched connected devices, review work-from-home technology policies, strengthen network monitoring for abnormal traffic patterns and adopt more behavior-based defenses rather than relying solely on known threat indicators.”

For more information on this or other cyber risk issues, contact Riggi at jriggi@aha.org. For the latest cyber and risk resources and threat intelligence, visit aha.org/cybersecurity.