China just built a hidden door into America's power grid for wartime use
1 day ago · 11 November 2026Share
Control room of a power plant. File photo. Magnetic Rahim · CC BY-SA 4.0
China's military has a hidden back door into America's power plants, water systems and hospitals.
A retired US admiral just said so out loud.
And here's the scary part. Nobody's using it yet.
It's just sitting there. Ready.
Rear Admiral Mark Montgomery said it a few hours ago at Cyberweek, a cybersecurity conference at Tel Aviv University. He spent 32 years in the US Navy. Now he runs cyber research at a Washington think tank called the Foundation for Defense of Democracies.
He was talking about Volt Typhoon. That's a Chinese state-backed hacking group.
He says quote "Power plants, nuclear facilities, water systems, hospitals" are all at risk.
Now, this isn't some brand new hack. Microsoft first named Volt Typhoon back in May 2023.
Then in February 2024, the FBI, the NSA and America's cybersecurity agency CISA put out an advisory. It confirmed Volt Typhoon had broken into IT networks across America's energy, water, transport and communications sectors. Even Guam.
And here's the part that should worry you. In some of those networks, the hackers had quietly kept access for at least five years.
So why would anyone sit on access for five years and not use it?
Because that's the whole point of this kind of operation.
Volt Typhoon doesn't plant obvious malware. It uses ordinary admin tools already sitting on the network. So its activity just looks like normal computer use.
In one confirmed case, at a water utility, the hackers spent nine months quietly moving from computer to computer. They ended up right next to the equipment that actually runs the plant.
The rest of this story is for members.
High voltage power grid of the United States. File photo. Wikideas1 · CC0
So the access isn't being used to cause damage right now. It's being kept ready. For later.
Montgomery says that's exactly why China worries him more than Iran. He says China already knows what is going on, everywhere.
America has tried to shut this down before. In January 2024, the FBI announced it had broken up a botnet of hacked home and office routers, called the KV Botnet, that Volt Typhoon was using to cover its tracks. Christopher Wray, the FBI Director at the time, said the botnet let China hide while it targeted America's communications, energy, transport and water sectors.
And it happened again more recently.
About eleven weeks ago, the Justice Department and the FBI seized two hacking platforms called QScan and QTRouter. These belonged to a separate Chinese state-backed group, tracked as QTFY. Court documents say that group had been targeting American infrastructure since at least 2018.
An FBI document from that case named the targets. Power companies. Hospitals. Telecoms providers. Banks. Defence contractors. NASA. The Federal Reserve. The Department of Energy. The Department of Justice. Health and Human Services. The National Institutes of Health. Even the US Senate.
That's most of the US government. And most of the country's essential services. Named in one document.
But here's an important gap. Those same court documents found power-company networks had been targeted. They did not show that the actual machinery running the electric grid had been compromised, or used to cause blackouts.
Getting into a company's office network is not the same as reaching the equipment that keeps the lights on. Though CISA's advisory shows Volt Typhoon has got close before.
Montgomery says big US banks have spent heavily on cybersecurity for years. He says other sectors haven't matched that spending. So the gaps are still there.
China has not commented on Volt Typhoon since any of this came out.
So what don't we know? How much of this access has actually been removed. Threat researchers say that, as of this month, there's still no confirmed case of Volt Typhoon being fully wiped from US infrastructure networks. Nobody has said whether new access points are still going in, or how many systems have been locked down since the seizures eleven weeks ago.
Montgomery's point is simple. This isn't about an attack happening today.
It's about a door that's been left open. And it stays open until somebody decides to walk through it. In a war.
Nothing here was paid for by an advertiser. Members are the entire business model. Bronze is where it starts, and it opens the last seven days in full.
