“[We] have confirmed that Volt Typhoon has compromised the IT environments of multiple critical infrastructure organizations in the continental and non-continental United States and its territories, including Guam,” CISA said in an advisory, warning that the hacking team’s choice of targets and pattern of behavior is not consistent with traditional cyber espionage or intelligence gathering operations.

The CISA advisory includes detailed technical mitigations to harden attack surfaces and the agency recommends that defenders start hunting for similar malicious activity linked to the Chinese hackers.