By Yuan Hong

    After China released an investigationHYPERLINK "https://www.globaltimes.cn/page/202404/1310584.shtml" \t "_self", the US, in order to cover up the evidence, instructed related companies to change the content of report they released previously, completely disregarding the traces left during the operation. This shows that the US side is at its wits' end when the truth is revealed, and will stop at nothing to smear China, researchers from China's National Computer Virus Emergency Response Center (CVERC) told the Global Times on Sunday.

    On May 24, 2023, the cybersecurity authorities from The Five Eyes countries - the US, the UK, Australia, Canada and New Zealand, issued a joint cybersecurity advisory, claiming that they had discovered a cluster of activities of interest associated with a "China state-sponsored cyber actor," known as Volt Typhoon, and these activities "affected networks across US critical infrastructure sectors."

    In response, China's CVERC, National Engineering Laboratory for Computer Virus Prevention Technology and 360 Digital Security Group conducted a joint investigation and further analysis found that Volt Typhoon has more correlation with ransomware group or other cybercriminals.

    Multiple cybersecurity authorities in the US have been pushing "China-sponsored" "Volt Typhoon" false narrative just for seeking more budgets from the US Congress. Meanwhile, Microsoft and other US cybersecurity companies also want more big contracts from US cybersecurity authorities, according to a report about the investigation.

    Lin Jian, spokesperson of China's Ministry of Foreign Affairs, said on April 15, 2024 that according to the report, "Volt Typhoon" is actually a ransomware cybercriminal group who calls itself the "Dark Power" and is not sponsored by any state or region. There are signs that in order to receive more congressional budgets and government contracts, the US intelligence community and cybersecurity companies have been secretly collaborating to piece together false evidence and spread disinformation about so-called Chinese government's support for cyberattacks against the US.

    The CVERC, National Engineering Laboratory for Computer Virus Prevention Technology and 360 Digital Security Group released a special report on Monday, suggesting that the "Volt Typhoon" plan is a conspiracy and fraud operation planned and implemented by US government agencies targeting the US Congress and taxpayers, the Global Times learned.

    Its purpose is to create imaginary enemies in order to preserve the important legal weapon of the US maintaining its cyber hegemony, the Section 702 of the Foreign Intelligence Surveillance Act (Section 702), and to continuously strengthen the "comprehensive control" of the global cyberspace granted by this clause's "warrantless surveillance power." This is used to suppress and exclude foreign competitors who are unwilling to cooperate with US intelligence agencies in implementing network surveillance, in order to maintain US cyber hegemony and long-term interests.

    Change evidence

    After the release of the investigation report on "Volt Typhoon," the Chinese joint investigation team continued to track the actions and intentions of the US in creating the "Volt Typhoon" false narrative.

    "We conducted verification analysis based on the indicators of compromise (IoCs) of the so-called 'Volt Typhoon' organization in the US, and found that this organization is closely related to a ransomware criminal group called Dark Power disclosed by ThreatMon, a US cybersecurity vendor," said the researcher.

    The report directly quotes the content of the ThreatMon report and discloses the associated IP address information hidden behind the back cover image." The researcher said that after the release of the investigation report, the US side instructed ThreatMon to openly change the content of the report, the entire report has been expanded from 17 pages to 20 pages, but the crucial evidence of the associated IP address, which was originally located behind the back cover image, is now nowhere to be found.