China’s Stealthy Hackers Infiltrate U.S. and Guam Critical Infrastructure Undetected

May 25, 2023Ravie LakshmananCyber Threat / Espionage

A stealthy China-based group managed to establish a persistent foothold into critical infrastructure organizations in the U.S. and Guam without being detected, Microsoft and the “Five Eyes” nations said on Wednesday.

The tech giant’s threat intelligence team is tracking the activity, which includes post-compromise credential access and network system discovery, under the name Volt Typhoon.

The state-sponsored actor is geared towards espionage and information gathering, with the cluster active since June 2021 and obscuring its intrusion footprint by taking advantage of tools already installed or built into infected machines.

Some of the prominent sectors targeted include communications, manufacturing, utility, transportation, construction, maritime, government, information technology, and education.

The company further assessed with moderate confidence that the campaign is “pursuing development of capabilities that could disrupt critical communications infrastructure between the United States and Asia region during future crises.”

A defining characteristic of the attacks is the “strong emphasis” on staying under the radar by exclusively relying on living-off-the-land (LotL) techniques to exfiltrate data from local web browser applications and leverage stolen credentials for backdoor access.

The main goal is to sidestep detection by harmonizing with regular Windows system and network activities, indicating that the threat actor is deliberately keeping a low profile to gain access to sensitive information.

“In addition, Volt Typhoon tries to blend into normal network activity by routing traffic through compromised small office and home office (SOHO) network equipment, including routers, firewalls, and VPN hardware,” Microsoft said.

Another unusual tradecraft is the use of custom versions of open source tools to establish a command-and-control (C2) channel over proxy as well as other organizations’ compromised servers in its C2 proxy network to hide the source of the attacks.

In one incident reported on by the New York Times, the adversarial collective breached telecommunications networks on the island of Guam, a sensitive U.S. military outpost in the Pacific Ocean, and installed a malicious web shell.

The initial entry vector involves exploiting internet-facing Fortinet FortiGuard devices by means of an unknown zero-day flaw, although Volt Typhoon has also been observed weaponizing flaws in Zoho ManageEngine servers. The access is then abused to steal credentials and break into other devices on the network.

The Windows makers also noted it directly notified targeted or compromised customers and provided them with the necessary information to secure their environments.

It, however, warned that it could be “particularly challenging” to mitigate such risks when threat actors make use of valid accounts and living-off-the-land binaries (LOLBins) to pull off their attacks.

Secureworks, which is monitoring the threat group under the name Bronze Silhouette, said it has “demonstrated careful consideration for operational security […] and reliance on compromised infrastructure to prevent detection and attribution of its intrusion activity.”

The development also comes as Reuters disclosed that Chinese hackers targeted Kenya’s government in a far-reaching three-year-long series of attacks against key ministries and state institutions in an alleged attempt to obtain information about the “debt owed to Beijing by the East African nation.”

The digital offensive is suspected to have been carried out by BackdoorDiplomacy (aka APT15, Playful Taurus, or Vixen Panda), which is known to target government and diplomatic entities across North America, South America, Africa, and the Middle East at least since 2010.