Microsoft said the group of hackers, known as Volt Typhoon, tried to attack US military bases in Guam. China rejects the claims.
ADVERTISEMENTState-backed Chinese hackers have been targeting US critical infrastructure and could be laying the technical groundwork for the potential disruption of communications between the US and Asia during future crises, Microsoft has warned.
The targets include sites in Guam, where the US has a major military presence, the company added.
Microsoft said in a blog post on Wednesday that the state-sponsored group of hackers, which it calls Volt Typhoon, has been active since mid-2021.
It said organisations affected by the hacking - which seeks persistent access - are in the communications, manufacturing, utility, transportation, construction, maritime, information technology and education sectors.
Separately, the National Security Agency, the FBI, the Cybersecurity and Infrastructure Security Agency (CISA) and their counterparts from Australia, New Zealand, Canada and Britain - known as the Five Eyes - published a joint advisory sharing technical details on “the recently discovered cluster of activity".
On Thursday, the Chinese government hit back, saying the allegations “lacked evidence” and accusing the US of being “the empire of hacking”.
"It's clear this is a collective disinformation campaign of the Five Eyes coalition, launched by the US for geopolitical reasons," Chinese foreign ministry spokesperson Mao Ning told reporters.
A Microsoft spokesman would not say why the software giant was making the announcement now or whether it had recently seen an uptick in the targeting of critical infrastructure in Guam or at adjacent US military facilities there, which include a major air base.
John Hultquist, chief analyst at Google's Mandiant cybersecurity intelligence operation, called Microsoft's announcement “potentially a really important finding".
“We don’t see a lot of this sort of probing from China. It’s rare,” Hultquist said.
“We know a lot about Russian and North Korean and Iranian cyber-capabilities because they have regularly done this".
China has generally withheld using the kinds of tools that could be used to seed, not just intelligence-gathering capabilities, but also malware for disruptive attacks in an armed conflict, he added.
Microsoft said the intrusion campaign placed a “strong emphasis on stealth” and sought to blend into normal network activity by hacking small-office network equipment, including routers. It said the intruders gained initial access through Internet-facing Fortiguard devices, which are engineered to use machine-learning to detect malware.
“For years, China has conducted aggressive cyber operations to steal intellectual property and sensitive data from organisations around the globe", said CISA director Jen Easterly, urging mitigation of affected networks to prevent possible disruption.
Bryan Vorndran, the FBI cyber division assistant director, called the intrusions “unacceptable tactics” in the same statement.
Tensions between Washington and Beijing - which the US national security establishment considers its main military, economic and strategic rival - have been on the rise in recent months.
Those tensions spiked last year after then-House Speaker Nancy Pelosi’s visit to democratically governed Taiwan, leading China, which claims the island as its territory, to launch military exercises around Taiwan.
US-China relations became further strained earlier this year after the US shot down a Chinese spy balloon that had crossed the United States.
