Cyber Warfare Escalation: Unveiling the New Era of U.S.-China Digital Conflict

At a Glance

• Salt Typhoon Breaches Intensify Tensions and Highlight Critical Infrastructure Vulnerabilities
• Government Response and Congressional Oversight
• International Criticism and Competitive Tensions
• Analytical Perspective: Enhancing Cyber Warfare Preparedness

Incoming Trump Administration Faces Immediate Cybersecurity Challenges After PRC Hacks

As Trump prepares to take office, U.S.-China relations face mounting tension, intensified by the recent "Salt Typhoon" hack targeting U.S. telecom networks. The breach signals rising cyber threats and AI rivalry, prompting urgent calls for strategic dialogue to avoid conflict and stabilise ties.

With President-elect Donald Trump poised to take office, the United States is set to enter an even more contested future with China amid escalating threats in cyber warfare and the technological AI race. As the "dust hasn't even settled yet" on the recent U.S. election results, the incoming Trump administration faces immediate cybersecurity challenges following significant breaches by China's state-sponsored hacking group "Salt Typhoon."

These hackers infiltrated major U.S. telecommunications companies, accessing sensitive cellular logs and user data. The incidents intensify cyber tensions between the U.S. and China, highlighting urgent concerns over federal response measures and critical infrastructure protection amidst intensifying economic and political competition.

Salt Typhoon Breaches Intensify Tensions and Highlight Critical Infrastructure Vulnerabilities

The cyber battlefield between the United States and China has escalated dramatically with the recent infiltration of major U.S. telecommunications companies by Chinese state-sponsored hacking groups, notably "Salt Typhoon." This series of breaches has not only heightened cyber tensions between the two nations but also exposed significant vulnerabilities in critical infrastructure, prompting urgent calls for enhanced cybersecurity measures and international cooperation.

Detailed Profiles of Chinese Cyber Threat Actors

Currently, three primary "Typhoon" threat actor groups have been publicly identified, each employing sophisticated tactics and targeting critical sectors:

1. Volt Typhoon: Known for utilizing "living off the land" techniques, Volt Typhoon leverages built-in network tools to achieve objectives without deploying detectable malware. Their operations focus on U.S. critical infrastructure with the intent to disrupt rather than conduct espionage. By blending into normal network activities, they make detection and attribution exceedingly difficult.
2. Flax Typhoon: Linked to PRC information security firms operating under government direction, Flax Typhoon targets critical infrastructure in Taiwan and the United States. They also employ "living off the land" methods and have compromised numerous Internet of Things (IoT) devices to form botnets. In September 2024, the U.S. government dismantled one such botnet, highlighting the pervasive threat they pose.
3. Salt Typhoon: Allegedly responsible for breaching U.S. telecommunications firms in October 2024, Salt Typhoon focuses on counterintelligence by gathering data on PRC targets under U.S. surveillance. They gained unprecedented access to sensitive cellular logs, including Call Detail Records (CDRs) containing detailed information about phone calls, messages, and user locations. The U.S. government has yet to officially confirm these attacks or the group's existence, adding layers of complexity to the attribution process.

Marie O'Leary, a cybersecurity analyst at the International Institute for Strategic Studies, remarked, 

"The scale and audacity of the Salt Typhoon hacks suggest a new level of cyber espionage that could destabilize international relations. This isn't just an attack on the United States; it's a wake-up call for the international community about the vulnerabilities inherent in our interconnected digital infrastructure."

Government Response and Congressional Oversight

The U.S. Congressional Research Service has highlighted these breaches, raising critical questions about the adequacy of the federal response and the measures needed to protect critical infrastructure. Members of Congress from both the House and Senate have expressed deep concerns, calling on U.S. companies and federal agencies to provide detailed information about the incidents.

"Congress might also consider oversight of the executive branch’s response, particularly the immediate response and discovery of the incident," noted a recent report by cybersecurity expert Jaikaran. 

"The incident raises concerns about the privacy of Americans’ communications, the security of critical infrastructure, and cybersecurity deterrence policy."

Jaikaran also emphasised the need for policymakers to focus on the roles of the Cyber Unified Coordination Group (UCG), the Cyber Safety Review Board (CSRB), Sector Risk Management Agencies (SRMAs), and preparedness activities. The Cyber UCG has been utilised in previous significant cyber events, such as the Microsoft Exchange services compromise in 2021 and the SolarWinds incident, to coordinate a whole-of-government response integrated with private sector efforts.

International Criticism and Competitive Tensions

Global leaders and cybersecurity experts have expressed grave concerns over the implications of these breaches. Dr. Alan Chen, a professor of international relations at Georgetown University, stated, 

"Cybersecurity has become a pivotal issue in international politics, and incidents like these can influence public opinion and policy decisions. The perception of foreign interference, especially from a major competitor like China, adds a layer of complexity to the geopolitical landscape."

The breaches have reignited debates over the trade relationship between the U.S. and China. Economic analysts warn that continued cyber hostilities could spill over into the economic sphere, potentially leading to new trade barriers or tariffs. Lisa Martinez, an economist at the Brookings Institution, commented, 

"Cyber espionage activities exacerbate distrust and could prompt retaliatory measures that impact global markets. Businesses are wary of the uncertainty this creates, especially in sectors heavily reliant on international supply chains."

Earlier this year, the U.S. Justice Department charged seven Chinese nationals with "conspiracy to commit computer intrusions and conspiracy to commit wire fraud." This announcement came on the heels of warnings from Cybersecurity and Infrastructure Security Agency (CISA) Director Jen Easterly and National Cyber Director Harry Coker about the strategic shift of Chinese hackers targeting critical infrastructure.

Analytical Perspective: Enhancing Cyber Warfare Preparedness

The escalating cyber threats have prompted calls for enhanced preparedness. Jaikaran highlighted that Congress has repeatedly directed CISA to engage in explicit preparedness activities, such as planning and conducting exercises. These activities help stakeholders think through potential incidents, establish roles and responsibilities, understand capabilities, and develop a shared sense of actions and outcomes.

"CISA developed a cyber incident response plan at the end of the Obama Administration and is required to update that plan by the end of 2024," Jaikaran noted. "With regard to the communications sector, participation in preparedness efforts appears to be primarily focused on their role as an essential service to other sectors like energy and financial services."

Despite intelligence community warnings about adversaries' intent to target and disrupt the communications sector, the U.S. government's focus on the sector's inherent risks is not as evident. Congress may consider how CISA incorporates changes in the sector, federal organizations, and threat actors into preparedness activities and how lessons learned from past incidents are applied to future responses.

Outlook: Balancing Security and Stability Amidst Political Transition

As the United States navigates a period of political transition with the incoming administration in 2025, the cyber landscape faces new challenges. The "dust hasn't even settled yet" on the recent election results, and the new government has signalled a commitment to rebuilding the nation's technological and trade foundations. This strategic focus is expected to intensify economic competition and heighten political tensions on the global stage.

Diplomatic efforts, robust cybersecurity strategies, and international cooperation are essential to mitigate the risks. Marie O'Leary emphasized,

"In this interconnected world, cyber threats are a shared challenge. Our response must be collaborative, informed, and resolute to safeguard the future."

Experts caution that unilateral actions may exacerbate existing tensions. Dr. Alan Chen reflected,

"A strong national strategy is crucial, but it must be balanced with international collaboration to prevent further escalation."

Only through collective action and effective communication can the international community navigate this contested future successfully. Establishing norms and agreements to prevent cyber conflicts from escalating into broader crises is imperative for global security and economic stability.