Loading story…
Australia’s Security Intelligence Organisation (ASIO) has issued strong warnings that authoritarian states, particularly China, are increasingly willing and capable of conducting cyber-enabled sabotage against critical infrastructure. ASIO Director-General Mike Burgess highlighted the growing risk of foreign governments targeting essential services such as telecommunications, power, water, and financial systems, emphasizing that these threats are no longer hypothetical. Recent telecom outages in Australia, which have already had severe consequences, were cited as examples of the potential impact, and Burgess warned that advances in technology and the proliferation of cyber capabilities are making it easier for hostile regimes to acquire the tools needed for such attacks.
Burgess specifically identified China-linked advanced persistent threat (APT) groups, including Volt Typhoon and Salt Typhoon, as actively probing and, in some cases, gaining access to Australian critical infrastructure. These groups are reportedly positioning themselves for future sabotage and espionage operations, with Volt Typhoon targeting power, water, and transport networks, and Salt Typhoon focusing on telecom infrastructure to steal sensitive data. The warnings come amid reports that Chinese officials have tacitly admitted to cyberattacks on U.S. infrastructure, further underscoring the seriousness of the threat landscape facing Australia and its allies.
See the actors and campaigns active against you right now.
1 event from the most recent confirmed update back to the earliest known activity.
Australia's spy chief publicly warned that authoritarian nations are prepared to conduct high-impact cyber sabotage against Australia's critical infrastructure. Reporting on the warning highlighted China-linked activity as a key concern in the threat landscape.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
3 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcego.theregister.com
Open sourcesecurityaffairs.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
U.S. officials and cybersecurity experts have highlighted the ongoing threat posed by nation-state actors, particularly the Chinese-linked group known as Salt Typhoon, which has conducted widespread cyber intrusions targeting critical American infrastructure. These campaigns have focused on stealing intellectual property, surveilling government officials, and pre-positioning within essential networks such as airports, hospitals, water treatment facilities, and telecom providers, with the intent to disrupt services or gather intelligence at a time of their choosing. The persistence and sophistication of these operations underscore the urgent need for coordinated defense efforts between government agencies and the private sector, as most critical infrastructure is privately owned or operated. Recent incidents attributed to Salt Typhoon include the compromise of multiple U.S. telecom networks, with attackers maintaining access for nearly a year before detection. These breaches exemplify the evolving nature of hybrid and cross-domain threats, where cyber intrusions can cascade into physical and reputational risks. Security leaders are being urged to adopt new, asymmetric approaches to risk management, breaking down traditional silos and ensuring that intelligence and response capabilities keep pace with the rapidly changing threat landscape.
Jul 12, 2026
Hackers associated with China have gained unauthorized access to the IT networks of hundreds of small and medium-sized water utilities and other critical infrastructure providers across the United States. These intrusions are believed to be part of a broader strategy to position Chinese actors to sabotage American water and power supplies in the event of a geopolitical conflict, particularly if tensions escalate over Taiwan. U.S. officials have been aware of this threat for over two years, and recent reporting has brought renewed attention to the scale and persistence of these cyber operations. The targeted utilities are often located in rural areas and small towns, which typically lack the cybersecurity resources and expertise of larger metropolitan systems. The operational technology (OT) systems that control water treatment and distribution are especially vulnerable due to their increasing automation and remote accessibility. The risk is compounded by a significant resource gap, as many of these utilities struggle to defend against sophisticated nation-state threats. Efforts to bolster defenses have included the launch of two non-profit initiatives aimed at supporting critical infrastructure operators, but these programs face their own limitations. One of the non-profits has paused its activities to recalibrate its approach, while the other is only able to provide assistance in a limited number of states due to resource constraints. The threat underscores the broader challenge of protecting critical infrastructure in the United States, where many essential services are managed by small organizations with limited budgets. The potential for cyber sabotage of water and power systems raises concerns about the resilience of civilian infrastructure in the face of international conflict. U.S. government agencies have issued warnings and guidance to utilities, but implementation of robust security measures remains inconsistent. The situation highlights the need for increased investment in cybersecurity for critical infrastructure, particularly in rural and underserved areas. The ongoing threat from Chinese-linked hackers demonstrates the strategic importance of water and power utilities as potential targets in modern cyber warfare. The exposure of these vulnerabilities has prompted calls for greater public-private collaboration and federal support. The risk is not limited to water utilities, as other sectors of critical infrastructure may face similar threats from state-sponsored actors. The revelations serve as a wake-up call for the urgent need to address cybersecurity gaps in essential services. The possibility of coordinated attacks on infrastructure during a geopolitical crisis could have far-reaching consequences for national security and public safety. The current state of preparedness among small utilities is insufficient to counter the scale and sophistication of the threat. The situation remains dynamic, with ongoing efforts to assess and mitigate the risks posed by foreign cyber actors.
Jul 12, 2026
UK National Cyber Security Centre CEO Richard Horne said the agency handled more than 200 cyber incidents affecting UK critical national infrastructure and its supporting ecosystem between June 2025 and May 2026, with about **75%** assessed as linked to hostile states including Russia, China and Iran. Speaking at the RUSI Annual Security Lecture, Horne said cyber security must be treated as a continuous contest rather than a static risk-management problem, warning that adversaries are already pre-positioning in infrastructure for possible future disruption and citing **Volt Typhoon** as a prominent example. Horne described the threat across "far," "mid" and "near" digital spaces, arguing that governments and allies must combine intelligence, sanctions, law enforcement and offensive cyber operations while industry and government work together to secure cloud, telecoms and open-source ecosystems. He warned that AI will accelerate vulnerability discovery and attack scaling, with attackers likely to apply AI-enabled capabilities against known weaknesses in legacy critical infrastructure technology, and urged organizations to strengthen foundational controls, improve resilience and recovery, and replace unsupported systems.
Aug 11, 2026