The Chinese intrusion affected organizations spanning the communications, utilities, education and government sectors including in Guam, a key foothold for American forces in the Indo-Pacific. The incident was disclosed in May 2023, with Microsoft describing the years-long operation as hard to detect and malicious.

The attack is likely to inspire copycats, said Maj. Gen. Lorna Mahlock, the commander of the Cyber National Mission Force. The CNMF, part of Cyber Command, deploys around the world to unearth malware and fortify digital defenses.

“I think we’re seeing Volt Typhoon activity continuing to persist. That’s in open source. We’re also seeing other actors using the tactics, techniques and procedures,” Mahlock said April 30 at the Modern Day Marine defense conference in Washington. “The greatest form of flattery is to copy.”

U.S. officials have long considered China a serious cyber hazard, with the International Institute for Strategic Studies think tank placing it in the second tier of its cyber powerhouse rankings alongside Russia. The Pentagon’s 2023 cyber strategy warned both Beijing and Moscow are prepared to unleash cyberattacks on critical infrastructure and defense networks should war break out.

The groundwork is being laid today. Volt Typhoon relied on so-called living-off-the-land techniques to lurk around vital systems and go largely unnoticed.

Attacks on critical infrastructure — food and water delivery, health care services, defense contracting and more — could jeopardize U.S. military response across the world as well as a sense of stateside calm. A ransomware attack on Colonial Pipeline in 2021 resulted in a run on fuel across the Southeast and aggravated concerns about energy security.

“Open-source reporting talks about this actor, out of China, who has access to our critical infrastructure and some of our key capabilities. Why? Not just for foreign intelligence-collection,” Mahlock said.

“We’ve seen this actor, China, grow in scope, scale and sophistication,” she added. “We’ve also seen that they’re undeterred.”

Army Gen. Michael Kurilla told lawmakers on March 7 that he would “love” to have the Navy deploy more directed-energy arms capable of downing drones. Having supplemental directed energy on hand, he added, would also mean expending fewer U.S. missiles, which can cost millions of dollars a pop. Iranian drones being funneled to extremist groups can cost thousands of dollars each.

“The bigger concern is if you start talking about swarms. We need to continue to invest in things like high-power microwave to be able to counter a drone swarm that is coming at you,” Kurilla said during the Senate Armed Services Committee hearing in Washington. “Nothing is 100%. At some point the law of statistics will come up. You have to have a layered defense.”

High-energy lasers and microwave weapons are capable of zapping overhead threats in ways dissimilar to traditional munitions and at a fraction of the cost. Lasers can fire at the speed of light and punch holes through material, while microwaves can fry electronics at a distance, rendering tech obsolete. Both are considered a critical element of layered defense, or having multiple countermeasures ready to thwart different threats in different situations.

The Defense Department has for decades pitched money into directed-energy weapons, an average $1 billion annually in the past three years, according to the Government Accountability Office, a federal watchdog.

At least 31 directed-energy initiatives are underway across the department, with some more mature than others. Among them are Lockheed Martin’s High Energy Laser with Integrated Optical-dazzler and Surveillance, or HELIOS, installed aboard the Navy destroyer Preble in 2022, and Epirus’ Leonidas, delivered to the Army in 2023 in furtherance of its Indirect Fire Protection Capability.

Bringing such systems to fruition — let alone mass production — has proven tricky. Aside from their technological complexity, laser- and microwave-based weaponry demand precious components and materials such as germanium and gallium.

Kurilla on Wednesday said the Army “sent us some directed-energy mobile short-range air defense” that are being experimented with. He provided no details about initial results. The service dispatched four Stryker-mounted 50-kilowatt laser prototypes in February, Breaking Defense reported.

Militants across the Greater Middle East have in recent months conducted more than 175 attacks on U.S. and allied forces. A drone strike in Jordan, at the Tower 22 installation near al-Tanf garrison, killed three troops in January. A Houthi missile attack on a commercial ship in the Gulf of Aden this month killed three crew members, as well, and forced an evacuation of the vessel.

“This is not the same central region as last year,” Kurilla said. “Iran’s expansive network of proxies is equipped with advanced, sophisticated weaponry, and threatens some of the most vital terrain in the world with global and U.S. implications.”

The new primary military occupational specialty ― called the command and control interface control officer ― will be responsible for coordinating the use of networks and ensuring insights derived from battlefield data are shared between commanders no matter the domain, according to a Marine administrative message published Tuesday.

To be eligible for the job, listed as the military occupational specialty 7216, enlisted Marines must have expertise in existing and emerging communication practices and technologies. That includes Link 16 ― a secure, jam-resistant network used by NATO.

The Corps specifically wants Marines who also have a background in managing airspace.

The warrant officer job is open to enlisted Marines who hold the military occupational specialties low altitude air defense gunner (7212), tactical air defense controller (7236), air support operations operator (7242), air traffic controller (7257) or senior air traffic controller (7291).

The Corps is establishing the job as part of an effort to update command and control amid the sweeping revamp known as Force Design. The service has expressed interest in adapting the aviation community’s command-and-control approach more broadly.

“Our aviation C2 organizations and tactical employment concepts are well-defined and recognized by the joint force,” the service wrote in a 2022 planning document on Force Design. “We are considering new C2-specific formations using our approach to aviation C2 as a model.”

The new role arrives as the Defense Department pursues what’s known as Combined Joint All-Domain Command and Control, or CJADC2.

The multibillion-dollar concept envisions an interlinking of land, air, sea, space and cyber forces’ networks, allowing the best-positioned and best-equipped unit to strike first. For now, many of the military’s databases and applications are siloed or service-specific, impeding what defense officials have said are critical exchanges of information.

The proliferation of advanced communications equipment and digital threats prompted the creation of the new warrant officer position, the Marine Corps said.

Once Marines are selected as command and control interface control officers, they must complete the warrant officer basic course and attend the joint interface control officer course, according to the administrative message. More advanced command-and-control and air-operations courses are “recommended” for these warrant officers.

Marines who are interested in the promotion should look out for a future Marine administrative message called “Fiscal Year 2025 Enlisted to Warrant Officer Regular Selection Board MARADMIN,” according to Tuesday’s message.

While the department investigates what type of drone slipped past air defenses and hit a desert installation known as Tower 22 near Syria, preliminary evidence suggests the attack was the workings of Kataib Hezbollah, according to Pentagon spokesperson Sabrina Singh. The group emerged in the early 2000s and has since been blamed for violence across Iraq.

“In terms of attribution for the attack, we know this is an [Islamic Revolutionary Guard Corps]-backed militia. It has the footprints of Kataib Hezbollah, but not making a final assessment on that,” she said during a Jan. 29 briefing at the Pentagon. “Our teams are continuing to do the analysis, but we know Iran is behind it.”

The Iranian government denied involvement but has long supplied combatants in advancement of its own goals.

Assets from the regime have been used by Houthi rebels in Yemen to harass ships in the Red Sea and Gulf of Aden, deployed by Russian forces in their continued invasion of Ukraine and were reportedly exported to Ethiopia and Sudan.

“There are a whole host of airframes and systems that Iran-backed militias in Iraq have been parading for the past few years that show telltale signs of Iranian support,” Behnam Ben Taleblu, a senior fellow at the Foundation for Defense of Democracies think tank, told C4ISRNET. “Via these parades, we have seen Iran-backed groups tip their hand as to new capabilities made available by their patron in Tehran.”

Such armaments include reusable Mohajer unmanned aerial vehicles capable of dropping bombs and smaller one-way attack drones such as the Shahed series.

The Defense Intelligence Agency, a principal source of foreign intelligence for U.S. military endeavors, in August showed reporters charred remains of Shahed-101 and Shahed-131 drones and at least one defused warhead with a shaped charge, meant to punch through armor, and fragmenting cubes designed to harm personnel. The pieces were recovered from fighting well beyond Iran’s borders and assembled stateside for accountability.

“As has been the case in other theaters, one-way attack UAVs, popularly known as suicide drones, function as the poor man’s cruise missile. This means a lower and slower threat with a different flight profile compared to rockets and missiles that can take various angles of attack,” Taleblu said. “They are also cheaper to produce and exemplify the phrase ‘quantity has a quality of its own.’”

The attack on Tower 22, close to the al-Tanf garrison, is among the latest in a barrage targeting U.S. forces. The Defense Department has since mid-October logged at least 165 attacks in the region, including 66 in Iraq and 98 in Syria.

What casts the Tower 22 bombardment in such sharp relief is the fact that it “was so tragically successful,” according to Jonathan Lord, a senior fellow and director of the Middle East Security Program at the Center for a New American Security think tank. That difference could be seen as a significant escalation in an area already inflamed.

“I think it also foot-stomps the fact that these militias have been trying to kill Americans for months. These aren’t shots across the bow, these aren’t warnings or demonstrations of might. They’re trying to kill people,” Lord said in an interview. “I think what is under debate right now is who’s going to bear the brunt of that response, and where will that be borne.”

The U.S. military has successfully countered overhead threats like rocket fire and explosive unmanned systems for months, including in the Red Sea. The guided-missile destroyer Carney in December batted down 14 drones that U.S. Central Command described as a wave.

In some cases, exemplified by the DIA display, scraps can be retrieved and studied. Engines, exhaust pipes, wing stabilizers, circuitry, landing gear and more can all aid experts in identifying make, model or origin.

“There may be recoverable parts. There could be radar reflections the military has that might give them a better sense. They might have more signature information,” Lord said. “I’m certain that CENTCOM knows, exactly, where this originated.”

The Wall Street Journal reported the drone that hit Tower 22 may have been mistaken for an American drone that was in the air at the same time. Defense officials said the circumstances are under investigation.

Maj. Gen. Lorna Mahlock succeeded Army Maj. Gen. William Hartman at the helm of the CNMF during a ceremony Jan. 5. Hartman, who led the force since 2019, is taking another post as Cyber Command’s deputy chief.

Mahlock in a statement said she felt humbled to serve alongside “our nation’s elite cyber warriors, competing daily against a threat that is very real, but which few can comprehend, quantify or see.”

The CNMF was established in 2014 and has since deployed more than 55 times to 27 countries — including Ukraine, ahead of Russia’s latest invasion, and Albania, in the wake of Iranian cyberattacks — to identify network weaknesses and unearth malicious software. Its elevation to a subordinate unified command within CYBERCOM in 2022 was recognition of its critical role in stateside election defense and overseas sweeps.

“CNMF has always been the ‘go-to’ force when our nation has a challenge in the cyber domain,” Army Gen. Paul Nakasone, the CYBERCOM and National Security Agency boss, said in a statement. “These joint cyber operators are a powerhouse that punch above their weight against some of the world’s most reckless and determined foreign malicious cyber actors.”

Nakasone presided over the change of command Friday.

Mahlock previously served as the deputy director for combat support at the NSA’s cybersecurity directorate. She was also the first Black woman to serve as a two-star general in the Marine Corps, and was its first female chief information officer and director of command, control, communications and computers.

A prior-enlisted Marine, Mahlock received her commission in 1991. She holds multiple master’s degrees, plus a master’s certificate in information operations from the Naval Postgraduate School.

Marine Corps Times reporter Irene Loewenson contributed to this article.

Frederick Douglass Moorefield Jr., a deputy chief information officer for command, control and communications, was one of two men the Justice Department on Oct. 2 said was apprehended following an investigation into the alleged animal abuse and underground gambling. The other was Mario Damon Flythe.

The Washington Post reported the Defense Department was “aware of the criminal complaint” and that Moorefield was “no longer in the workplace,” citing a department spokesperson.

The deputy CIO for command, control and communications lends expertise and guidance on policy and technical issues related to defense connectivity and data-sharing standards. It also plays a role in spectrum-sharing decisions.

Police searched the Maryland homes of Moorefield and Flythe in early September. They rescued 12 dogs, according to the Justice Department, and recovered veterinary steroids, training regimens, a carpet “that appeared to be stained with blood” and a weighted dog vest. An electrical plug and jumper cables — likely used to kill losing dogs — were also found, an affidavit alleges.

Moorefield was released after being arraigned, records show. If convicted, he could face five years in prison.

Maxim Marchenko, originally from Russia, was arrested outside the U.S. this week and extradited to Westchester County, New York, documents filed in federal court show. He’s facing several charges, including alleged conspiracy to defraud the U.S., conspiracy to commit wire fraud and the smuggling of goods.

The dual-use technologies Marchenko is accused of surreptitiously middle-manning for Russia — namely OLED micro-displays from a company based in Dutchess County, New York — can be used for medical imaging and rifle scopes, video games and night-vision goggles, according to the U.S. Department of Justice.

The tech is subject to export administration regulations, which govern shipments overseas. Shell companies allegedly run by Marchenko funneled more than $1 million into the U.S. between May 2022 and August 2023.

“We are laser-focused on rooting out the procurement networks fueling the Russian war machine,” Assistant Secretary for Export Enforcement Matthew Axelrod said in a statement Sept. 18. “Working hand-in-hand with our federal law enforcement partners, we will continue to identify and disrupt Russia’s use of front companies in the People’s Republic of China and elsewhere to evade our controls.”

Microelectronics play a critical role in modern military technology. And erosion of microelectronic capacities threatens national security, U.S. analysts have warned. The CHIPS and Science Act, passed last summer, allocated $2 billion for related research, fabrication and workforce training.

Russian military hardware, including drones, radios and electronic warfare devices, are reliant upon Western-sourced components, the court documents note. To access them, especially now, as export controls tighten, “Russia relies on third-party transshipment hubs and clandestine procurement and payment networks,” they continue.

“Disrupting the efforts of facilitators and procurement agents like Marchenko, who use their skills and connections to advance the agenda of the Russian war machine, is one of the most important priorities” of Task Force KleptoCapture, said its co-director, David Kim.

The task force was launched in March to enforce sanctions, export restrictions and other economic measures the U.S. levies in response to Russia’s continued attacks on Ukraine. Task force members include agents and analysts from the FBI, Marshals Service, Secret Service and Department of Homeland Security.

Marchenko could face tens of years in prison. Conspiracy to defraud the U.S. carries a maximum penalty of five years, for example. Conspiracy to commit wire fraud carries 20.

Court documents show Marchenko is represented by a federal public defender and is expected to seek bail.

The comments at the Air and Space Forces Association’s Air, Space and Cyber Conference here continued the Pentagon’s recent pattern of confronting Sen. Tommy Tuberville, R-Alabama, over his six-month blockade of general officer nominations over the department’s abortion policy. And they mark a noticeable difference in how Pentagon officials, particularly uniformed officers, tend to approach differences with Capitol Hill, which are usually handled behind the scenes or with gentler public phrasing.

Tuberville objects to the Pentagon’s decision, after the U.S. Supreme Court overturned Roe v. Wade, to allow troops to take leave to travel to another state to receive abortion services if they serve in a state that bans such care.

More than 300 general officer nominations are now held up by Tuberville’s holds, including Air Force Chief of Staff Gen. CQ Brown’s nomination to succeed Army Gen. Mark Milley as chairman of the Joint Chiefs of Staff. Milley is required by law to retire at the start of October. The Army, Navy and Marine Corps also are without confirmed service chiefs due to the hold.

Gen. Mark Kelly, the retiring head of Air Combat Command, warned in a roundtable with reporters Tuesday that the disruption and unfilled positions caused by the hold have not just unsettled allies and caused them to lose confidence in the United States’ competence but have also emboldened the nation’s adversaries.

“If you drive north … on Connecticut Avenue, that popping sound is not stray gunfire,” Kelly said. “It’s champagne corks in the Chinese Embassy, bouncing off the walls.”

In his keynote address to AFA on Monday, Air Force Secretary Frank Kendall led a round of applause for several general officers who have been waiting — in some cases up to half a year — for the Senate to confirm them in their new roles.

Though Kendall did not mention Tuberville by name in his address, he did call out the senator over perceived consequences.

“This is a situation that one senator has created for us,” Kendall said. “All these men and women, and their units and their families, are having their readiness and their lives negatively affected by your unprecedented actions.

“They are all doing their duty and making whatever sacrifice we ask of them — including the ones associated with your holds.”

Kendall, along with Army Secretary Christine Wormuth and Navy Secretary Carlos Del Toro, also co-authored an op-ed in the Washington Post and appeared on CNN earlier this month blasting Tuberville’s hold.

At AFA on Tuesday, Kelly — who noted he expected to be retired by now after Gen. Kenneth Wilsbach would have succeeded him — said he’s worried about the effect the hold is having on the military’s officer corps, allies and adversaries.

Officers and their families give a great deal when they serve in the military, he said, citing the disruptions to their children’s education and spouses’ employment opportunities that can come with military life.

But, Kelly said, their tolerance is not unlimited.

“Each [officer] has their own individual red line,” Kelly said. “I talk to them every day. And we’re on the fringe of losing a generation of champions, [in] my opinion.”

Kelly said the United States’ allies look to its military as “a beacon of competence and confidence” — but the nation’s current dynamic “does not instill confidence.”

“Some of them are interested and vexed, some of them are downright concerned,” Kelly continued. “We try to allay those concerns as much as possible, but it’s getting more challenging by the day.”

In his own remarks at AFA on Wednesday, Navy Adm. Christopher Grady, vice chairman of the Joint Chiefs of Staff, also highlighted the “human cost” to the hold and said it must be considered.

“It goes beyond” the general and flag officers, he said. “It goes all the way down to those [lieutenant colonels], who are looking up and waiting to move forward and can’t do it right now. That is challenging.”

“The fact that folks can’t plan for their moves or get their kids in school, that’s also challenging,” Grady continued. “There’s a very significant human dimension to this.”

Grady said Brown “definitely is the right man at the right time” to succeed Milley, and called for him to be confirmed.

Kendall said he and other defense leaders had constructive conversations with Tuberville in the past, and are happy to talk with him about the hold. But the secretary drew a line against changing the abortion policy that has incensed the Republican.

“As far as I can tell, we’re not going to change the policy. I see no indication of that,” Kendall said. “And I don’t think we should, quite frankly.

“So, we need to resolve this,” he continued. “It’s gone on long enough. It’s doing a lot of harm.”

Such tactics, meant to sow chaos, divert precious resources and paralyze military mobilization, were observed in Eastern Europe during Russia’s invasion of neighboring Ukraine, a conflict that colors the Pentagon’s new 2023 Cyber Strategy. An unclassified summary of the document was made public Sept. 12.

“The United States is challenged by malicious cyber actors who seek to exploit our technological vulnerabilities and undermine our military’s competitive edge,” its introduction reads. “They target our critical infrastructure and endanger the American people. Defending against and defeating these cyber threats is a Department of Defense imperative.”

Defense officials have long considered China and Russia national security hazards. While China poses the most-serious and long-term threat, they say, Russia presents more-immediate concerns. Both countries wield serious cyber arsenals. An International Institute for Strategic Studies report in 2021 placed China and Russia in tier two of its cyber powerhouse rankings. The U.S. sat in first.

The strategy, which supersedes a 2018 version, describes China as a “broad and pervasive” cyber espionage threat, one capable of absconding with defense trade secrets and monitoring U.S. citizens. It further labels Russia an online manipulator and harasser of critical infrastructure such as pipelines, hospitals and transportation.

“Cyber issues everywhere — in critical infrastructure, domestically and abroad — are something that’s front and center on the minds of our key senior leaders,” Gregory Touhill, a retired Air Force brigadier general and former federal chief information security officer, said Sept. 11 at a conference in National Harbor in Maryland. His comments came before the publication of the strategy’s summary.

“We continue to see critical infrastructure as a target for cyber-enabled attacks, including things like denial-of-service, malicious software, ransomware, theft of intellectual property,” he added. “We’re very concerned about that.”

The Pentagon’s strategy cleaves with the White House’s digital defense plans, which were rolled out in March. In them, the Biden administration vowed to employ “all instruments of national power” to disrupt and dismantle malicious cyber actors near and far.

Doing so will require significant collaboration with foreign governments, industry leaders and more.

“The nation’s constellation of diplomatic and defense relationships represents a foundational strategic advantage,” the Pentagon strategy reads. “In cyberspace, the capabilities of allies and partners combine with those of the United States to enable timely information sharing and interoperability as well as contribute to our collective security.”

Real-world employment of such technology would mark a significant step forward for the Corps and the Department of Defense, as both seek to exploit uncrewed systems, autonomy and hard-to-detect weaponry in preparation for a potential fight with China or Russia.

“We’re focused very heavily now on organic precision fires, loitering munitions. There’s a lot of areas there that I think we can accelerate, because industry is, clearly, cutting the path for us,” Lt. Gen. Karsten Heckl, leader of Marine Corps Combat Development Command, said at the Sept. 6 Defense News Conference in Pentagon City. “The idea of loitering munitions coming off unmanned surface vessels, loitering munitions coming out of unmanned underwater vessels — you can let your imagination run wild, and we’re pushing the envelope on all of those.”

The wide-ranging application of drones — for spying and targeting, and for one-way trips culminating in an explosion — has been observed in the Russia-Ukraine war. So-called exploding drones target vehicles and infantry alike, often with deadly effect.

While Marines have yet to test a combination of USV, UUV and attack drones en masse, trials are possible in the near future. Boeing’s extra-large Orca could be a candidate, according to Heckl. The company in July published footage of an Orca beneath the waves, its mast extended, but provided few additional details.

“We’re not experimenting, but we will,” Heckl told reporters at the conference. “Imagine a fully autonomous UUV that can go out, get to within X range of an area, surface and launch thousands of loitering munitions that are fully autonomous, and then slip back below the surface.”

The Corps’ much-discussed revamp, Force Design 2030, includes a call to quickly develop and field loitering, swarming munitions.

Gen. Eric Smith, the acting commandant, on Wednesday said the Corps will “continue to add drone technology, autonomous systems, artificial intelligence” into its mix. A squadron this year became the only Marine unit in the Indo-Pacific to reach an early operational milestone with the General Atomics MQ-9 Reaper, Marine Corps Times reported.

“The MQ-9s? Boom, in the Pacific. We said we were going to put them in the Pacific, and they’re there,” Smith said. “They’re also in Central Command, doing some pretty robust work.”

Defense News reporter Megan Eckstein contributed to this article.