How Conflict With China Might Play Out in the Cyber Realm
For technology leaders, the key issue is not whether a hostile campaign can cause disruption, but how much operational loss the business can tolerate before response decisions become incoherent. The article points to a threat model where localized outages, communications loss or degraded services are more likely than a headline-grabbing nationwide blackout. That shifts the management question from crisis prediction to defining thresholds: which services must be restored first, who has authority to declare an incident, and how cross-functional command works under pressure.
This is as much an operating-model problem as a security problem. Critical infrastructure organizations often depend on interdependent vendors, legacy assets and distributed ownership, which can blur accountability when an intrusion is suspected. CIOs and CISOs should ask whether resilience plans are owned centrally or fragmented across business units, plant teams and service providers. If the answer is fragmented, then recovery speed and decision quality will likely depend on improvisation rather than rehearsal.
The practical trade-off is between efficiency and survivability. Hardening, segmentation, patch discipline and monitoring are rarely glamorous investments, but the article makes clear that attackers often exploit ordinary weaknesses and persistence tools already present in the environment. Leaders should therefore pressure-test whether budget is being spent on visible controls while basic restoration capability, backup validation, identity hygiene and third-party oversight remain underfunded.
Next questions for boards and executive teams should be blunt: Which disruptions would force manual workarounds, what is the maximum acceptable downtime by service, and who can make fast trade-offs between containment and continuity? Information sharing matters, but so does converting that intelligence into measurable preparedness. Without agreed decision rights and tested recovery playbooks, threat awareness may rise faster than actual resilience.
The Possibility of Disruptive Cyberattacks
The US has 16 critical infrastructure sectors. โAll of them are called critical because they would impact society to some degree were they to be taken offline,โ says Eric Knapp, CTO of OT forโฏOPSWAT, a company focused on critical infrastructure cybersecurity. โAnd they’re all susceptible to cyberattack to some degree.โ Telecommunications and power could be prime targets for China in a conflict. โBack from the dawn of time when people would go to war, you would try to eliminate your opponentโs ability to communicate and their ability to power their systems,โ says Knapp. But other sectors, such as water, health care, food, and financial services, could be targeted as well. โThe intent of these kind of operations may be to provide a distraction in order to โฆ slow down a US response, if there was to be one, in any sort of conflict involving Taiwan,โ says Rafe Pilling, director of threat intelligence for the counter threat unit at cybersecurity company Secureworks. While it is uncertain exactly how these attacks would play out, there are real-world examples of how adversaries can attack critical infrastructure to their advantage. โUnfortunately, there’s a roadmap that we can look at that’s happening in the real world right now in the Russia-Ukraine conflict,โ says Knapp. Leading up to and following Russiaโs invasion of Ukraine, Russia executed many cyberattacks on Ukrainian critical infrastructure, including its power grid. If China were to use its positioning in US critical infrastructure to carry out similarly disruptive attacks, they would be dealing with very distributed systems. It would be very unlikely to see something like a nationwide power outage, Knapp tells InformationWeek. โWhat you’d likely see is a cascade of smaller localized disruptions,โ says Pilling. Those disruptions could still be very impactful, potentially causing chaos, physical harm, death, and financial loss. But they would not last forever. โMany of these sectors, for reasons completely unrelated to cyberattacks, are used to being able to resolve issues, work around problems, and get services up and running quickly,โ says Pilling. โResiliency and quick restoration of services, particularly in the energy sector, [are] an important part of their day-to-day planning.โ Related:Does Cyber Insurance Drive Up Ransom Demands?Threat Actors
Salt Typhoon and Volt Typhoon are two widely recognized, Chinese cyber threat groups that target US critical infrastructure. โAll [of] these different Chinese threat actor groups, they have different motivations, different goals, different countries that they’re attacking,โ says Jonathan Braley, director of threat intelligence at nonprofit Information Technology-Information Sharing and Analysis Center (IT-ISAC). In addition to pre-positioning for disruptive cyberattacks, motivations could also include intellectual property theft and espionage. While Salt Typhoon is the suspected culprit behind the major breach in the US telecommunications sector, it actively targets victims in other sectors as well. For example, the group reportedly targeted hotels and government, according to FortiGuard Labs. โTargeting hotels and targeting telcos is often to get information about people’s movements and what they’ve been saying to each other and who they’ve been communicating with. So, it’s part of a collection for a wider intelligence picture,โ says Pilling. Volt Typhoon has targeted systems in several critical infrastructure sectors, including communications, energy, transportation, and water, according to CISA. โThey combine a number of tactics that make them quite stealthy,โ says Pilling. For example, Volt Typhoon makes use of living off the land techniques and will move laterally through networks. It often gains initial access via known or zero-day vulnerabilities. โIn some cases, they would use malware but for the vast majority of cases โฆ they were using built-in tools and things that were already deployed on the network to achieve their aims of maintained persistence in those networks,โ Pilling shares. Salt Typhoon and Volt Typhoon are just two groups out of many China-backed threat actors. IT-ISAC has adversary playbooks for threat actors across many different countries of origin. โWe have about 50 different playbooks for different Chinese nation state actors, which is a lot,โ Braley tells InformationWeek. โI think if we look at other countries there might be a dozen or so.โ While China-linked threat groups pose a risk to critical infrastructure, they are not alone. โAs we approach various global conflicts, we need to be prepared that not only we’re going to have these nation states coming out, [but] we also [have] to watch some of these hacktivist groups that are aligned with these countries as well,โ says Braley.Preparing Critical Infrastructure
The government and critical infrastructure operators both have roles to play in preparing for the potential of disruptive cyberattacks. Information sharing is vital. Government agencies like CISA can continue to raise awareness. Critical infrastructure operators can share insight into any malicious activity they discover to help other organizations. Critical infrastructure operators also have a responsibility to harden their cybersecurity posture. โA lot of the basic hygiene that organizations need to be doing is not expensive cutting-edge cybersecurity work. It’s the basics of making sure things are patched, minimizing attack surfaces externally, making sure that there is good monitoring across the network to detect intrusions early when they occur,โ says Pilling. โI think it’s a culture and a mind shift as much as need for more budget.โEnjoyed this article? Sign up for our newsletter to receive regular insights and stay connected.