Plan ahead High Monitor
Volt Typhoon rotates short-lived hacked devices to hide its access
CyberScoopcritical infrastructure
What happened. Lumen's Black Lotus Labs reports that Volt Typhoon, a China-backed group, uses chains of compromised home-office routers, internet of things devices and enterprise equipment. The chains are rebuilt daily and used to exploit edge device flaws, including zero-days.
Who is affected. Critical infrastructure networks, especially those with internet-facing network edge devices. The source does not name specific vendors or products.
What to do. Review your network edge devices for signs of compromise, and brief your security team on this activity.
When to act. Plan ahead: review your exposure to the same entry point
Editor's reading
ForOT security leaddetection engineerIT security
- Purdue level
- L5
- L4
Why: The activity targets internet-facing network edge devices and compromised routers, which sit at the enterprise edge (L5) and enterprise IT (L4).
- Are you exposed?
List the internet-facing edge devices you run and check their patch status and any unexplained connections from small-office or consumer devices.
- If you cannot fix it yet
- Remove management interfaces of edge devices from the internet and restrict them to known administration hosts.
- Segment edge devices so that a compromise cannot reach OT networks directly.
- Watch for
- Inbound connections from home-office routers and consumer internet of things devices to your edge devices and remote-access services.
- Edge device configuration changes, new accounts or unexpected outbound sessions from edge equipment.
- ATT&CK for ICS
- T0866Exploitation of Remote Services
Inferred from the facts above, not stated by the source. Check it against your own site before acting.
Source: CyberScoop (opens cyberscoop.com)
More on Critical infrastructure