Volt Typhoon (aka, The Bronze Silhouette) Targets Critical US Infrastructure with Living Of The Land Techniques

Indicators of Compromise

APT Groups

Notes

<div><b>Conclusion:</b></div><div><b><br></b></div><div>Microsoft has uncovered stealthy and targeted malicious activity focused on post-compromise credential access and network system discovery aimed at critical infrastructure organizations in the United States. The attack is carried out by <b>Volt Typhoon</b>, a state-sponsored actor based in China that typically focuses on espionage and information gathering.&nbsp;</div><div><br></div><div>Microsoft assesses with moderate confidence that this <b>Volt Typhoon</b> campaign is pursuing development of capabilities that could disrupt critical communications infrastructure between the United States and Asia region during future crises.</div><div><br></div><div>It is particularly difficult to reduce the risk from enemies like the Volt Typhoon, which rely on valid accounts and terrain binaries (LOLBins). Detection of activities using normal login channels and system binaries requires behavioral monitoring. The fix requires closing or changing credentials for compromised accounts. Accounts suspected of being compromised or affecting systems should be investigated</div><div><br></div>

Mitigation

<div><b>Mitigations</b></div><div>The authoritative agencies recommend organizations implement the mitigations below to improve your organization’s cybersecurity posture on the basis of the threat actor’s activity. These mitigations align with the Cross-Sector Cybersecurity Performance Goals (CPGs) developed by CISA and the National Institute of Standards and Technology (NIST). The CPGs provide a minimum set of practices and protections that CISA and</div><div>NIST recommends all organizations implement. CISA and NIST based the CPGs on existing cybersecurity Frameworks and guidance to protect against the most common and impactful threats and TTPs.</div><div><br></div><span style="color: var(--q-dark);">Defenders should harden domain controllers and monitor event logs for and similar process creations. Additionally, any use of administrator privileges should be audited and validated to confirm the legitimacy of executed commands.</span><br><span style="color: var(--q-dark);">Administrators should limit port proxy usage within environments and only enable them for the period of time in which they are required.</span><br><span style="color: var(--q-dark);">Defenders should investigate unusual IP addresses and ports in command lines, registry entries, and firewall logs to identify other hosts that are potentially involved in actor actions In addition to host-level changes, defenders should review perimeter firewall configurations for unauthorized changes and/or entries that may permit external connections to internal hosts.</span><br><span style="color: var(--q-dark);">Defenders should also look for abnormal account activity, such as logons outside of normal working hours and impossible time-and-distance logons (e.g., a user&nbsp;logging on from two geographically separated locations at the same time).</span><br>