up:: The Threat MOC

The Attacks That Produce No Event

The short version: (Addie writes this. It is the claim the whole piece rests on, and it is where the voice lives.)

In February 2024, CISA, the NSA and the FBI published a joint assessment of a Chinese state-sponsored group operating inside United States critical infrastructure. The finding that separates it from every other advisory of that year sits in two clauses: the actors’ behavior was “not consistent with traditional cyber espionage or intelligence gathering operations,” and the actors “do not exfiltrate data.”

Nothing was taken. The assessment rested entirely on what the access was positioned to enable later.

What does a security program do with an intrusion that steals nothing?

Mostly, it does not see it. The modern security stack is built to detect events: a file leaves, a credential is used from a new country, a process spawns something it should not, a volume of data crosses a boundary. Every one of those is a change in state that a control can be pointed at. Pre-positioning produces none of them, because holding access and doing nothing looks like an authorised user doing very little.

The operational consequence is that the same techniques which make pre-positioning hard to detect are also the ones that make it cheap to sustain. Living-off-the-land tradecraft uses the tools already on the machine, so there is no malware to match and no binary to hash. Patience is not a cost the way exfiltration bandwidth is a cost.

This is the shape that should worry a security leader more than the volume of ransomware, and it is the one that receives less attention, because it produces nothing to write an incident report about.

Why does this matter for how programs are funded?

Security budgets are argued for with incidents. An incident is legible: it has a date, a cost, an affected system and a lesson. A category of operation that produces no incident produces no line item, and it stays unfunded not because anyone decided against it but because the mechanism that funds work never fires.

Look at what that means in practice. If the measure of a program is mean time to detect, an operation designed to generate nothing to detect scores perfectly. If the measure is number of incidents closed, it contributes zero. If the board asks what happened this quarter, the accurate answer about pre-positioned access is that nothing happened, which is precisely the wrong sentence for the situation.

The metric is not wrong on its own terms. It is measuring the thing it was designed to measure, and that thing has stopped covering the threat surface.

Where else does this pattern already appear?

There is a second, quieter version of the same problem, and it is worth naming because it is running now rather than being anticipated.

Copying encrypted traffic breaks nothing. The session completes, the data arrives, the integrity checks pass, and the recipient sees exactly what they expected to see. An adversary who records that traffic and stores it has taken nothing anyone can point at, has degraded no service, and has triggered no control. The value of the recording depends entirely on a future capability to read it, which is the same structure as pre-positioning with the arrow reversed: there, the access is placed and the intent arrives later; here, the data is taken and the capability arrives later.

The United States government has publicly attributed a telecom-scale interception campaign to actors affiliated with the People’s Republic of China, covering customer call records at scale, the private communications of people in government and political life, and data subject to court-ordered law-enforcement requests. That attribution establishes appetite and access at the carrier layer. What a collector does with carrier access beyond the named categories is exactly the question this class of operation forces, and it is a question the evidence does not answer.

Both cases share the property that makes them hard: the absence of an alert is what the threat model predicts. A quiet quarter is consistent with nothing happening and equally consistent with the operation working.

So what should a security leader actually do about it?

Three things follow, and none of them requires believing a specific forecast.

Stop treating absence of detection as evidence of absence. For this class, silence is the designed outcome. The question worth asking your team is not whether anything has been detected but whether the environment would produce a detectable event at all if this were happening, and the answer for pre-positioning in operational technology is frequently no.

Move some assurance from detection to structure. If a category cannot be detected reliably, the defensible position is to reduce what the access is worth: segmentation that limits what pre-positioned access can reach, credential hygiene that limits how long it stays valid, and inventory good enough that you know which systems an adversary would choose. These are unglamorous and they do not generate metrics, which is a large part of why they lose budget arguments to tooling.

Rank your data by how long it has to stay secret. Anything with a confidentiality requirement measured in decades is already exposed to the recording case regardless of what any future capability turns out to be. That ordering is a business question rather than a cryptographic one, and it is answerable today by people who do not need to follow the underlying research.

What the advisory actually describes

Every control in the environments described above was working. The advisory does not describe a failure of endpoint protection or a missed patch. It describes an adversary operating within what the controls were built to permit, doing nothing the controls were built to prohibit, and being identified on the basis of judgment about intent rather than on the basis of an alert.

That is the durable lesson, and it generalises past this actor and this decade. State-level adversaries do not usually break controls. They satisfy them.

(Close: Addie writes this.)

Frequently asked questions

If nothing was stolen, was there actually an attack? Yes. Access to a control system is itself the objective when the intended use is disruption at a chosen moment rather than collection. The federal assessment reclassified the activity on that basis.

Does this mean detection tooling is useless? No. It means detection covers a smaller share of the threat surface than its metrics imply, and the uncovered share needs assurance from structure rather than from alerts.

How would I know if this were happening to us? Frequently you would not, which is the finding. The practical substitute is asking whether your environment would generate a detectable event at all under this scenario, and treating a no as a gap rather than as reassurance.

Is the encrypted-traffic case speculative? The recording is documented practice and the attribution of carrier-layer interception is public. What a specific collector intends to do with a specific archive is inferred rather than observed, and this piece marks which is which.

What is the cheapest first move? Rank data by how long it must stay confidential. That is a business exercise, it needs no cryptographic expertise, and it produces the ordering every later decision depends on.

Sources

• CISA, NSA, FBI and partners, “PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure,” advisory AA24-038A, 7 February 2024, cisa.gov, for the “not consistent with traditional cyber espionage or intelligence gathering operations” assessment and the “do not exfiltrate data” finding.
• FBI and CISA, “Joint Statement on the People’s Republic of China Targeting of Commercial Telecommunications Infrastructure,” 13 November 2024, cisa.gov, for the three named categories of theft at the carrier layer.

⚠️ Draft, not for publication. Both documents sit behind a host that refuses automated clients, so neither has been re-read against its text in this draft. The first URL is the one the Guide already cites for these same findings in Is Harvesting Encrypted Data an Act of Cyber Conflict. Before this note ships, both need a hand download through source-cache.sh add and a claim-level read, per the Field Guide’s data-integrity rule. The short version and the close are also still blank.

By Addie LaMarr. Last verified 2026-09-02.