CISA: Volt Typhoon had access to some U.S. targets for 5 years

Patience and persistence

Volt Typhoon is dangerous due to its extensive reconnaissance capabilities, discoveries and usage of zero-day vulnerabilities, and evasion techniques. U.S agencies even observed the actors targeting the personal emails of key network and IT staff in targeted organization. To gain initial access to a victim environment, Volt Typhoon is known to leverage both zero-day and known vulnerabilities in networking appliances.

The agencies urged organizations to secure internet-facing devices, which Volt Typhoon has targeted in the past. The joint advisory noted the group has gained access to IT networks by exploiting known or zero-day vulnerabilities in routers, VPNs and firewalls.

The agencies warn that Volt Typhoon typically exploited vulnerabilities in network devices from Fortinet, Ivanti Connect Secure, Netgear, Citrix and Cisco as primary Volt Typhoon initial access targets.

"In one confirmed compromise, Volt Typhoon actors likely obtained initial access by exploiting CVE-2022-42475 in a network perimeter FortiGate 300D firewall that was not patched. There is evidence of a buffer overflow attack identified within the Secure Sockets Layer (SSL-) VPN crash logs," the advisory read.

Volt Typhoon attacks have been publicly reported in the past, although it was previously not known that the group had contingency plans to launch disruptive attacks. In June, Carl Windsor, senior vice president of product technology and solutions at Fortinet, warned users that Volt Typhoon would likely exploit a critical Fortinet SSL VPN vulnerability, tracked as CVE-2023-27997.

Microsoft issued a similar warning the previous month, noting that Volt Typhoon was gaining initial access to critical infrastructure organizations through internet-facing Fortinet FortiGuard devices. Microsoft observed attacks against U.S. and Guam based communications, manufacturing, government, and transportation sectors, although at the time the company believed the activity was part of a cyber espionage effort.

The advisory said Volt Typhoon actors are also adept at leveraging credential access, often with administrative privileges, to move laterally within an environment. Those credentials are often stolen from poorly protected public-facing network appliances, the agencies warned.

In some instances, the agencies said threat actors used elevated credentials to gain OT access and take control of critical equipment and assets.

The advisory warned that access could lead to the compromise of heating, ventilation and air condition systems in server rooms or disrupt critical energy and water controls. The agencies confirmed that in some cases, Volt Typhoon also gained access to camera and surveillance system within critical infrastructure facilities.

Volt Typhoon actors exhibit significant patience after using credentials to gain access to legitimate accounts. The advisory emphasized that Volt Typhoon's objective is to maintain persistence within targeted organizations.

"This assessment is supported by observed patterns where Volt Typhoon methodically re-targets the same organization over extended periods, often spanning several years, to continuously validate and potentially enhance their unauthorized access. Evidence of their meticulous approach is seen in instances where they repeatedly exfiltrate domain credentials, ensuring access to current and valid accounts," the advisory read.

The agencies urged critical infrastructure to take immediate action to mitigate Volt Typhoon activity. Recommendations included patching internet-exposed systems and to prioritize patching vulnerabilities that Volt Typhoon frequently exploits; implementing phishing-resistant multifactor authentication; and review account permissions on edge appliances and network devices and removed any domain administrator privileges.

Arielle Waldman is a Boston-based reporter covering enterprise security news.