Volt Typhoon’s Reported Intrusions Use Compromised Network Appliances for C2 Relays
Summary
Huntress reviews reports of PRC-linked Volt Typhoon intrusions, which used compromised network appliances as C2 relays and legitimate tools after access. The article discusses uncertainty about the threat and recommends perimeter hardening and better visibility.
Key points
- Microsoft and Western intelligence and security agencies reported Volt Typhoon activity on May 24, 2023; multiple sources assessed the actor as linked to China.
- Reported activity since 2021 focused on exploiting external-facing services and appliances, including ManageEngine ADSelfService Plus (CVE-2021-40539).
- The actor reportedly compromised SOHO and security appliances to use as relay points, obscuring its origins and controlling infected endpoints.
- After access, reported tools included built-in administrative commands, RMM applications, 7zip, WinRAR and Impacket for lateral movement, credential harvesting and system information gathering.
- The article says observed activity indicated access development and information gathering; officials warned it could be preparatory for future disruption, but that capability was not established by the activity described.
- Huntress recommends hardening and patching external-facing systems, centralizing logs, monitoring network flows and improving endpoint visibility with EDR or similar tools.
Article Details
- Event Type
- Threat-intelligence analysis of Volt Typhoon activity, including exploitation of internet-facing services and network appliances and use of compromised devices as command-and-control relays.
- Impact
- Reporting described widespread activity since 2021, assessed as likely limited to initial-access development and information gathering in victim environments. US officials warned the intrusions could be preparatory work for future disruption of critical infrastructure, but the article noted no observed activity or capability beyond access development and information gathering.
MITRE ATT&CK
T1082 · System Information DiscoveryThe article reports system information gathering among Volt Typhoon's post-exploitation activities.T1090 · ProxyThe actor reportedly routed command-and-control traffic through legitimate, compromised assets, including SOHO devices used as relay points.T1190 · Exploit Public-Facing ApplicationVolt Typhoon reportedly exploited external-facing services and appliances to gain initial access.
CVE
Threat Actors
Vendors
AsusIdentified items in public reporting include, but are not necessarily limited to, equipment from ASUS, Cisco, D-Link, Netgear, and Zyxel.CiscoIdentified items in public reporting include, but are not necessarily limited to, equipment from ASUS, Cisco, D-Link, Netgear, and Zyxel.D-Linkitems in public reporting include, but are not necessarily limited to, equipment from ASUS, Cisco, D-Link, Netgear, and Zyxel.FortinetFortinet FortiGuard devicesNETGEARin public reporting include, but are not necessarily limited to, equipment from ASUS, Cisco, D-Link, Netgear, and Zyxel.PaesslerPaessler PRTG monitoring softwareZohoZoho ManageEngine ADSelfService Plus (CVE-2021-40539)Zyxelreporting include, but are not necessarily limited to, equipment from ASUS, Cisco, D-Link, Netgear, and Zyxel.
Products
7ZipThird-party administrator tools and scripts, including remote management and maintenance (RMM) applications and archive tools such as 7zip and WinRARPaessler PRTGPaessler PRTG monitoring softwareWinRARThird-party administrator tools and scripts, including remote management and maintenance (RMM) applications and archive tools such as 7zip and WinRAR
Tools
Countries
Industries
communicationsTyphoon must be taken seriously, if only out of caution. Organizations in these verticals, such as communications and electric utilities, should employ whatever means possible to evict these actors from compromisedElectric utilitiesseriously, if only out of caution. Organizations in these verticals, such as communications and electric utilities, should employ whatever means possible to evict these actors from compromised networks, and follow