Volt Typhoon Attacks U.S. Critical Infrastructures Using LOTL Techniques

Published 04/01/2024

I. Targeted Entities

U.S. Critical Infrastructure

II. Introduction

CISA, NSA, and FBI have confirmed that Volt Typhoon has compromised the IT environments of multiple critical infrastructure organizations—primarily in Communications, Energy, Transportation Systems, and Water and Wastewater Systems Sectors—in the continental and non-continental U.S. and its territories, including Guam.

Volt Typhoon’s choice of targets and pattern of behavior are not consistent with traditional cyber espionage or intelligence-gathering operations, and the U.S. authoring agencies assess with high confidence that Volt Typhoon actors are pre-positioning themselves on IT networks to enable lateral movement to OT assets to disrupt functions.

These actors could use their network access to achieve disruptive effects in the event of geopolitical tensions and/or military conflicts. (Cybersecurity and Infrastructure Security Agency, 2024)

III. Additional Background Information

In December 2023, an operation disrupted a botnet comprising hundreds of U.S.-based small office/home office (SOHO) routers that were hijacked by state-sponsored hackers from the People’s Republic of China (PRC). The hackers, known to the private sector as “Volt Typhoon,” used privately owned SOHO routers infected with the “KV Botnet” malware to conceal the PRC origin of subsequent hacking activities targeting the U.S. and other foreign victims. These further hacking activities included a campaign targeting critical infrastructure organizations in the U.S. and elsewhere, which was the subject of a May 2023 advisory from the FBI, the National Security Agency, and CISA (Office of Public Affairs, 2024).

The KV Botnet primarily targets Cisco and Netgear routers, exploiting a vulnerability due to their “end of service” status. This means they were no longer receiving security patches or software updates from the manufacturer. The operation removed the KV Botnet malware from the routers and took additional steps to sever their connection to the botnet, including blocking communications with other devices used to control it (Office of Public Affairs, 2024).

Volt Typhoon employs a multi-faceted approach to infiltrate and compromise target networks, starting with comprehensive pre-compromise reconnaissance to understand the network architecture and operational protocols. They exploit vulnerabilities in public-facing network appliances to gain initial access, then aim to escalate privileges within the network, often targeting administrator credentials. Using valid credentials, they move laterally across the network, leveraging remote access services such as Remote Desktop Protocol (RDP) to reach critical devices, including domain controllers (DCs). Volt Typhoon conducts discovery within the network, utilizing stealthy tactics such as living-off-the-land (LOTL) binaries and PowerShell queries on event logs to extract critical information while minimizing detection. LOTL tools like ntdsutil, netsh, and systeminfo were used to gather information about the network service and system details. Also, Volt Typhoon implanted binary files such as SMSvcService.exe and Brightmetricagent.exe that can open reverse proxies between a compromised device and malicious C2 servers. The PowerShell script logins.ps1 was also observed collecting successful logon events on infected systems without being noticed. (Cybersecurity and Infrastructure Security Agency, 2024).

After achieving full domain compromise, Volt Typhoon extracts the Active Directory database (NTDS.dit) from the DC using techniques such as Volume Shadow Copy Service (VSS) to bypass file locking mechanisms. Additionally, Volt Typhoon uses offline password-cracking methods to crack hashed passwords, enabling elevated access within the network. With elevated credentials, Volt Typhoon focuses on strategic network infiltration, aiming to access Operational Technology (OT) assets, such as sensors and control systems. Volt Typhoon was observed testing access to OT systems using default vendor credentials and exploiting compromised credentials obtained through NTDS.dit theft. This access grants them the ability to disrupt critical infrastructure systems, such as HVAC and energy controls, posing a significant threat to infrastructure security (Cybersecurity and Infrastructure Security Agency, 2024).

The second vulnerability, CVE-2024-1708, is related to CWE-22 – Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’). Although it is considered less severe as it is unlocked by CVE-2024-1079, it must not be underestimated (Team Huntress, 2024). This vulnerability involves manipulating ZIP file paths when extracting its contents. Attackers can then modify these contents and execute malicious code (Poudel, 2024). To do this, a malicious actor needs to have both administrative credentials and create a malicious extension inside C:Program Files (x86)ScreenConnectApp_Extensions to write files anywhere within the folder (Team Huntress, 2024). Team Huntress showed that this ZipSlip attack was not necessary, as malicious actors can run code by accessing a ScreenConnect feature called “Extensions”. This could easily go unnoticed in a system, since no other extensions need to be installed (Team Huntress, 2024).

ConnectWise released a patched version of ScreenConnect on February 21^st, 2024, and recommends updating all versions from 23.9.7 onward to 23.9.8 (ConnectWise, 2024). As of today, February 22^nd, 2024, 3,800 instances of ScreenConnect have been identified as vulnerable and need to be updated to the latest version to prevent malicious actors from accessing the ScreenConnect environment. ConnectWise added that Cloud instances were automatically patched, whereas On-Prem partners need to install all required updates manually to remediate both vulnerabilities (ConnectWise).

IV. MITRE ATT&CK

• T1592 – Gather Victim Host Information
  Adversaries may obtain crucial details about victim hosts, including administrative data (e.g., name, assigned IP address) and configuration details (e.g., operating system). This information is gathered through various methods, including direct actions such as Active Scanning or Phishing, as well as by compromising sites to collect data from visitors.

• T1583.003 – Acquire Infrastructure: Botnet
  Adversaries may obtain compromised systems through purchasing, leasing, or renting botnets, which are networks of compromised systems. By utilizing these botnets, adversaries can orchestrate coordinated tasks, including subscribing to services such as booter/stresser services to launch large-scale activities such as Phishing or Distributed Denial of Service (DDoS) attacks.

• T1190 – Exploit Public-Facing Application
  Adversaries may exploit weaknesses in internet-facing systems, targeting software bugs, glitches, or misconfigurations. This may involve websites, databases, standard services, or network protocols, potentially leading to compromise. Cloud-based or containerized applications could provide access to underlying infrastructure, cloud/container APIs, or exploitation of weak access management. Edge network infrastructure and appliances may also be targeted. Frameworks like OWASP and CWE can be used to identify common web vulnerabilities that adversaries may exploit.

• T1078 – Valid Accounts
  Adversaries leverage compromised credentials for various purposes, such as Initial Access, Persistence, Privilege Escalation, or Defense Evasion. These credentials can circumvent resource access controls, provide persistent access to remote systems, and grant access to services such as VPNs or Outlook Web Access. Adversaries often opt for legitimate access to evade detection, and inactive accounts may be exploited to avoid detection. The overlap of permissions across systems poses a risk, enabling adversaries to pivot and gain high-level access while bypassing enterprise controls.

• T1068 – Exploitation for Privilege Escalation
  Adversaries may exploit software vulnerabilities to elevate privileges, capitalizing on programming errors in operating systems or kernel code to execute adversary-controlled actions. When operating with lower privileges, adversaries target higher-privileged components to escalate access, potentially reaching SYSTEM or root permissions. By exploiting vulnerabilities in drivers, adversaries may introduce a Bring Your Own Vulnerable Driver (BYOVD) to execute kernel-mode code.
• T1110.002 – Brute Force: Password Cracking
  Adversaries use password-cracking techniques to recover usable credentials, especially plaintext passwords, when they obtain credential material such as password hashes. Techniques such as OS Credential Dumping and Data from the Configuration Repository can provide hashed credentials. Adversaries may systematically guess passwords or use pre-computed rainbow tables outside the target network to crack hashes, obtaining plaintext passwords for unauthorized access.

• Other Relevant MITRE ATT&CK Techniques
  T1133, T1059, T1587.004, T1589, T1590, T1591, T1593.

V. Recommendations

• Apply patches
  Prioritize patching key assets, known exploited vulnerabilities, and vulnerabilities in appliances frequently exploited by Volt Typhoon, such as Fortinet, Ivanti, NETGEAR, Citrix, and Cisco devices.

• Limit the internet exposure of systems
  An infrastructure’s primary attack surface is the combination of the exposure to all its internet-facing systems. One way to reduce the likelihood of a Volt Typhoon attack is to avoid exposing systems to the internet when unnecessary.

• Secure credentials and sensitive data
  Ensure edge devices do not contain accounts or plaintext credentials that could provide admin access, and ensure that only authenticated and authorized users can access the data.

• Implement MFA and the principle of least privilege
  Make sure MFA is enabled for every account, and ensure that administrator accounts have only the minimum permissions.

• Secure remote access services
  Limit the use of RDP and other remote desktop services. If RDP is necessary, follow best practices, including auditing the network for systems that use RDP, closing unused RDP ports, and logging RDP login attempts.

• Implement network segmentation
  This practice can minimize the risk of lateral movement within networks, prevent and limit unauthorized access across domain boundaries, and isolate servers from other systems.

• Secure cloud assets
  Revoke unnecessary public access to the cloud environment by ensuring that services such as storage accounts, databases, and VMs are not publicly accessible unless necessary.

VII. IOCs (Indicators of Compromise)

CVE-2024-1709

VII. References

PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure Cybersecurity and Infrastructure Security Agency CISA. (2024, February 7). https://www.cisa.gov/news-events/cybersecurity-advisories/aa24038a#_Appendix_C:_MITRE

The U.S. government disrupts a botnet, and the People’s Republic of China used to conceal hacking of critical infrastructure. Office of Public Affairs | United States Department of Justice. (2024, January 31). https://www.justice.gov/opa/pr/us-government-disrupts-botnet-peoples-republic-china-used-conceal-hacking-critical

Contributing Security Analysts: Alessandro Lovadina, Joy Boddu, Likhitha Duggi