Researchers at Microsoft detailed a sophisticated cyberattack aimed at critical U.S. infrastructure, orchestrated by an alleged China-based state-sponsored actor.
The threat actor goes by the name, Volt Typhoon, has been active since mid-2021 and is suspected of preparing to disrupt U.S.-Asia communication networks in potential future crises. The sectors affected by the campaign include communications, manufacturing, utilities, transportation, construction, maritime, government, information technology and education.
Its campaign emphasizes stealth, using advanced techniques such as living-off-the-land binaries of LOLBins and hands-on-keyboard activity. The TTP include gathering credentials, staging data for exfiltration, and maintaining persistence in compromised systems using valid credentials.
The group obfuscates itself by attempting to blend with typical network activity by routing traffic through compromised small office and home office network equipment and establishing C2 channels over proxies using custom open-source tools.
The U.S. intelligence agencies first became aware of the Volt Typhoon campaign in February, at around the same time an alleged Chinese spy balloon crossed North America. The infiltration is focused on communications infrastructure in Guam and other parts of the U.S., alarming intelligence officials because Guam is vital to any response to a future invasion of Taiwan.
The researchers note that detecting and mitigating infiltration by Volt Typhoon can be difficult due to the use of valid accounts and LOLBins. To address compromised accounts, Microsoft has provided detailed information on Volt Typhoon’s activities, mitigation strategies, best practices, and details on how Microsoft 365 Defender detects such activity.
Microsoft has notified targeted or compromised customers directly and provided the necessary information to secure their systems.
Defending against this campaign
- Mitigate the risk of compromised valid accounts by enforcing strong MFA policies using hardware security keys or Microsoft Authenticator. Passwordless sign-in, password expiration rules, and deactivating unused accounts can also help mitigate risk from this access method.
- Reduce the attack surface. Microsoft customers can turn on the following attack surface reduction rules to block or audit some observed activity associated with this threat:
- Block credential stealing from the Windows local security authority subsystem (lsass.exe).Block process creations originating from PSExec and WMI commands. Some organizations may experience compatibility issues with this rule on certain server systems but should deploy it to other systems to prevent lateral movement originating from PsExec and WMI.
- Block execution of potentially obfuscated scripts.
- Harden the LSASS process by enabling Protective Process Light (PPL) for LSASS on Windows 11 devices. New, enterprise-joined Windows 11 (22H2 update) installs have this feature enabled by default. In addition, enable Windows Defender Credential Guard, which is also turned on by default for organizations using the Enterprise edition of Windows 11.
- Turn on cloud-delivered protection in Microsoft Defender Antivirus to cover rapidly evolving attacker tools, techniques, and behaviors such as those exhibited by Volt Typhoon.
- Run EDR in block mode so that Microsoft Defender for Endpoint can block malicious artifacts, even when your non-Microsoft antivirus does not detect the threat, or when Microsoft Defender Antivirus is running in passive mode. EDR in block mode works behind the scenes to remediate malicious artifacts that are detected post-compromise.
Indicators of Compromise
- baeffeb5fdef2f42a752c65c2d2a52e84fb57efc906d981f89dd518c314e231c
- b4f7c5e3f14fb57be8b5f020377b993618b6e3532a4e1eb1eae9976d4130cc74
- 4b0c4170601d6e922cf23b1caf096bba2fade3dfcf92f0ab895a5f0b9a310349
- c0fc29a52ec3202f71f6378d9f7f9a8a3a10eb19acb8765152d758aded98c76d
- d6ab36cb58c6c8c3527e788fc9239d8dcc97468b6999cf9ccd8a815c8b4a80af
- 9dd101caee49c692e5df193b236f8d52a07a2030eed9bd858ed3aaccb406401a
- 450437d49a7e5530c6fb04df2e56c3ab1553ada3712fab02bd1eeb1f1adbc267
- 93ce3b6d2a18829c0212542751b309dacbdc8c1d950611efe2319aa715f3a066
- 7939f67375e6b14dfa45ec70356e91823d12f28bbd84278992b99e0d2c12ace5
- 389a497f27e1dd7484325e8e02bbdf656d53d5cf2601514e9b8d8974befddf61
- c4b185dbca490a7f93bc96eefb9a597684fdf532d5a04aa4d9b4d4b1552c283b
- e453e6efc5a002709057d8648dbe9998a49b9a12291dee390bb61c98a58b6e95
- 6036390a2c81301a23c9452288e39cb34e577483d121711b6ba6230b29a3c9ff
- cd69e8a25a07318b153e01bba74a1ae60f8fc28eb3d56078f448461400baa984
- 17506c2246551d401c43726bdaec800f8d41595d01311cf38a19140ad32da2f4
- 8fa3e8fdbaa6ab5a9c44720de4514f19182adc0c9c6001c19cf159b79c0ae9c2
- d17317e1d5716b09cee904b8463a203dc6900d78ee2053276cc948e4f41c8295
- 472ccfb865c81704562ea95870f60c08ef00bcd2ca1d7f09352398c05be5d05d
- 3e9fc13fab3f8d8120bd01604ee50ff65a40121955a4150a6d2c007d34807642
