G1017: Volt Typhoon

Volt Typhoon has used commercial tools, LOTL utilities, and appliances already present on the system for network service discovery.[1]

Volt Typhoon has enumerated directories containing vulnerability testing and cyber related content and facilities data such as construction drawings.[1]

Volt Typhoon has identified key network and IT staff members pre-compromise at targeted organizations.[1]

Volt Typhoon has enumerated running processes on targeted systems including through the use of Tasklist.[2][4][1]

Volt Typhoon has moved laterally to the Domain Controller via RDP using a compromised account with domain administrator privileges.[1]

Volt Typhoon has used compromised Paessler Router Traffic Grapher (PRTG) servers from other organizations for C2.[4][1]

Volt Typhoon has used compromised devices and customized versions of open source tools such as FRP (Fast Reverse Proxy), Earthworm, and Impacket to proxy network traffic.[2][3][1]

Volt Typhoon has queried the Registry on compromised systems for information on installed software.[3][1]

Volt Typhoon relies primarily on valid credentials for persistence.[1]

Volt Typhoon has compromised small office and home office (SOHO) network edge devices, many of which were located in the same geographic area as the victim, to proxy network traffic.[2][3]

Volt Typhoon has created and accessed a file named rult3uil.log on compromised domain controllers to capture keypresses and command execution.[1]

Volt Typhoon has used legitimate looking filenames for compressed copies of the ntds.dit database and used names including cisco_up.exe, cl64.exe, vm3dservice.exe, watchdogd.exe, Win.exe, WmiPreSV.exe, and WmiPrvSE.exe for the Earthworm and Fast Reverse Proxy tools.[3][4][1]

Volt Typhoon has appended copies of the ntds.dit database with a .gif file extension.[4]

Volt Typhoon has used the Windows command line to perform hands-on-keyboard activities in targeted environments including for discovery.[2][3][4][1]

Volt Typhoon has gained initial access through exploitation of multiple vulnerabilities in internet-facing software and appliances such as Fortinet, Ivanti (formerly Pulse Secure), NETGEAR, Citrix, and Cisco.[4][1]

Volt Typhoon has attempted to obtain credentials from OpenSSH, realvnc, and PuTTY.[3]

Volt Typhoon has staged collected data in password-protected archives.[2]

Volt Typhoon has conducted extensive pre-compromise reconnaissance to learn about the target organization’s network.[1]

Volt Typhoon has archived the ntds.dit database as a multi-volume password-protected archive with 7-Zip.[4][1]

Volt Typhoon has obtained the victim's system timezone.[1]

Volt Typhoon has run `net group` in compromised environments to discover domain groups.[4]

Volt Typhoon has executed multiple commands to enumerate network topology and settings including `ipconfig`, `netsh interface firewall show all`, and `netsh interface portproxy show all`.[3]

Volt Typhoon has used multiple methods, including Ping, to enumerate systems on compromised networks.[2][4]

Volt Typhoon has leveraged WMIC for execution, remote system discovery, and to create and use temporary directories.[2][3][4][1]

Volt Typhoon has used VPNs to connect to victim environments and enable post-exploitation actions.[1]

Volt Typhoon has used Base64-encoded data to transfer payloads and commands, including deobfuscation via certutil.[4]

Volt Typhoon has copied web shells between servers in targeted environments.[4]

Volt Typhoon has conducted pre-compromise web searches for victim information.[1]

Volt Typhoon has discovered file system types, drive names, size, and free space on compromised systems.[2][3][4][1]

Volt Typhoon has targeted the personal emails of key network and IT staff at victim organizations.[1]

Volt Typhoon has run system checks to determine if they were operating in a virtualized environment.[2]

Volt Typhoon has used ntds.util to create domain controller installation media containing usernames and password hashes.[2][3][4][1]

Volt Typhoon has used the Ultimate Packer for Executables (UPX) to obfuscate the FRP client files BrightmetricAgent.exe and SMSvcService.ex) and the port scanning utility ScanLine.[1]

Volt Typhoon has used a version of the Awen web shell that employed AES encryption and decryption for C2 communications.[4]

Volt Typhoon has attempted to access hashed credentials from the LSASS process memory space.[2][1]

Volt Typhoon has selectively cleared Windows Event Logs, system logs, and other technical artifacts to remove evidence of intrusion activity.[1]

Volt Typhoon has used compromised Cisco and NETGEAR end-of-life SOHO routers implanted with KV Botnet malware to support operations.[1]

Volt Typhoon has conducted pre-compromise reconnaissance for victim host information.[1]

Volt Typhoon has used `netstat -ano` on compromised hosts to enumerate network connections.[3][4]

Volt Typhoon has executed `net user` and `quser` to enumerate local account information.[1]

Volt Typhoon has targeted the browsing history of network administrators.[1]

Volt Typhoon has used PowerShell including for remote system discovery.[2][3][1]

Volt Typhoon has used `wevtutil.exe` and the PowerShell command `Get-EventLog security` to enumerate Windows logs to search for successful logons.[3][1]

Volt Typhoon has gained initial access by exploiting privilege escalation vulnerabilities in the operating system or network services.[1]

Volt Typhoon has obtained a screenshot of the victim's system using the gdi32.dll and gdiplus.dll libraries.[1]

Volt Typhoon has used the built-in netsh `port proxy` command to create proxies on compromised systems to facilitate access.[2][1]

Volt Typhoon has exploited zero-day vulnerabilities for initial access.[1]

Volt Typhoon has used multi-hop proxies for command-and-control infrastructure.[1]

Volt Typhoon has conducted pre-compromise reconnaissance on victim-owned sites.[1]

Volt Typhoon has used public tools and executed the PowerShell command `Get-EventLog security -instanceid 4624` to identify associated user and computer account names.[3][4][1]

Volt Typhoon has used `netsh` to create a PortProxy Registry modification on a compromised server running the Paessler Router Traffic Grapher (PRTG).[1]

Volt Typhoon has used webshells, including ones named AuditReport.jspx and iisstart.aspx, in compromised environments.[4]

Volt Typhoon has used native tools and processes including living off the land binaries or “LOLBins" to maintain and expand access to the victim networks.[1]

Volt Typhoon has used Brightmetricagent.exe which contains a command- line interface (CLI) library that can leverage command shells including Z Shell (zsh).[1]

Volt Typhoon has used `net start` to list running services.[1]

Volt Typhoon has used commercial tools, LOTL utilities, and appliances already present on the system for group and user discovery.[1]

Volt Typhoon has compromised Virtual Private Servers (VPS) to proxy C2 traffic.[1]

Volt Typhoon has targeted network administrator browser data including browsing history and stored credentials.[1]

Volt Typhoon has conducted extensive reconnaissance pre-compromise to gain information about the targeted organization.[1]

Volt Typhoon has conducted extensive reconnaissance of victim networks including identifying network topologies.[1]

Volt Typhoon has collected window title information from compromised systems.[1]

Volt Typhoon has run `net localgroup administrators` in compromised environments to enumerate accounts.[3]

Volt Typhoon has obtained victim's screen dimension and display device information.[1]

Volt Typhoon has run `rd /S` to delete their working directories and deleted systeminfo.dat from `C:\Users\Public\Documentsfiles`.[4][1]

Volt Typhoon has used publicly available exploit code for initial access.[1]

Volt Typhoon has downloaded an outdated version of comsvcs.dll to a compromised domain controller in a non-standard folder.[1]

Volt Typhoon has obtained credentials insecurely stored on targeted network appliances.[1]

Volt Typhoon has used compromised domain accounts to authenticate to devices on compromised networks.[2][4][1]