VORANT. Threat Intelligence Sign in Get the full feed

China pre-positioning backdoors in US electrical grid infrastructure

routine vulnerability energyinfrastructuregovernment-national

Chinese state actors are establishing persistent access to US power grid control systems and supply chains, with potential to disrupt services during Indo-Pacific crisis or conflict.

US government and security officials have confirmed that China is actively conducting cyber operations against American electrical infrastructure, including backdoor implantation in power grid control systems and infiltration of the electrical supply chain. This activity represents strategic positioning to enable coercion, deterrence, or signaling during potential conflict, particularly around Taiwan contingencies. The threat is not theoretical—public reporting and government advisories document active pre-positioning of access points that could enable temporary disruption in gray-zone scenarios or larger-scale attacks during major conflict.

Defenders in the power sector should treat Chinese cyber and supply-chain exposure as a standing threat requiring integration into strategic planning. Key mitigation steps include: hardening control system equipment and network pathways, particularly for China-sourced devices; implementing rigorous vendor remote-access controls; diversifying suppliers and maintaining critical spares; and requiring security and transparency clauses in vendor contracts. The electricity sector should also conduct regular leadership-level tabletop exercises to build decision-making discipline under crisis conditions, monitor for geopolitical indicators that signal rising risk (military exercises, official narratives, vendor pressure, export controls), and share resilience best practices across the sector.

Detection guidance

Suspicious Script Execution from Supply Chain Tool Directories

ATT&CK T1059

Detection of command/script interpreters spawned from vendor-supplied or supply-chain software directories, indicative of compromised supply-chain binaries executing malicious payloads. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Suspicious Script Execution from Supply Chain Tool Directories
description: Detects command and scripting interpreters (PowerShell, cmd, bash, Python)
  spawned from vendor software or supply-chain tool installation paths. Targets pre-positioned
  backdoors injected into legitimate vendor-supplied utilities or control system software.
tags:
- attack.execution
- attack.t1059
- attack.t1195
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
    - \powershell.exe
    - \cmd.exe
    - \cscript.exe
    - \wscript.exe
    ParentImage|contains:
    - \Program Files\
    - \Program Files (x86)\
    ParentCommandLine|contains:
    - .exe
  filter_admin_tools:
    ParentImage|contains:
    - \Windows\
    - \System32\
  condition: selection and not filter_admin_tools
falsepositives:
- Legitimate vendor tools that invoke PowerShell for updates or diagnostics
- System administration utilities bundled with control system software
level: medium
id: ec18f9a9-75f2-5622-9256-82cd55d11093
status: experimental
author: Vorant

Persistence Mechanism via System Autostart Locations

ATT&CK T1547

Detection of registry modifications or file creation in boot-time autostart locations by non-standard processes, enabling persistence across system restarts in critical infrastructure. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Persistence Mechanism via System Autostart Locations
description: Detects modifications to HKLM or HKCU Run registry keys, or file creation
  in Windows startup folders, by processes originating from temporary or vendor directories.
  Typical backdoor persistence in control system environments.
tags:
- attack.persistence
- attack.t1547.001
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains:
    - HKLM\Software\Microsoft\Windows\CurrentVersion\Run
    - HKCU\Software\Microsoft\Windows\CurrentVersion\Run
    - HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
    Image|contains:
    - \Temp\
    - \AppData\
    - \ProgramData\
  filter_windows_update:
    Image|contains:
    - \Windows\System32\
    - \Windows\SysWOW64\
  condition: selection and not filter_windows_update
falsepositives:
- Software installers registering components in Run keys from temp staging directories
- User-initiated application setup from Downloads or AppData
level: high
id: 3d451485-8027-5a21-933a-2e5794a930a3
status: experimental
author: Vorant

Remote Access Service Enabled via Account Manipulation

ATT&CK T1098

Detection of account creation or privilege escalation paired with remote access service activation (RDP, SSH, WinRM), suggesting backdoor access preparation in infrastructure networks. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Remote Access Service Enabled via Account Manipulation
description: Detects suspicious account creation or group membership changes (esp.
  to Administrators or Remote Desktop Users) followed by or coinciding with remote
  access service (RDP, WinRM, SSH) enablement. Indicates pre-positioning of access
  in supply-chain compromise scenarios.
tags:
- attack.persistence
- attack.t1098
- attack.t1021
logsource:
  category: process_creation
  product: windows
detection:
  selection_user_add:
    CommandLine|contains:
    - /add
    - create
  selection_service_enable:
    CommandLine|contains:
    - sc config TermService start
    - sc start TermService
    - netsh advfirewall firewall set rule name="Remote Desktop"
    - Get-WindowsFeature Remote-Desktop-Services
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
  filter_admin_context:
    User|contains: SYSTEM
  condition: (selection_user_add or selection_service_enable) and not filter_admin_context
falsepositives:
- Legitimate system administration scripts enabling RDP for IT support
- Approved account provisioning workflows in enterprise environments
level: high
id: e87e9861-b561-504d-98b0-eb6d10a3bb99
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.atlanticcouncil.org/blogs/new-atlanticist/us-power-utilities-must-prepare-for-a-crisis-in-the-indo-pacific-heres-how-they-can-start

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free