Volt Typhoon: PRC state actor living off the land

NSA, CISA, FBI and their Five Eyes partners describe a PRC state-sponsored actor, also known as Volt Typhoon, that goes after US critical infrastructure mostly with built-in Windows tools. It rarely uses malware: wmic, ntdsutil and vssadmin copy ntds.dit off domain controllers and netsh interface portproxy forwards traffic, which blends in with normal admin activity and slips past endpoint detection; Impacket and a custom FRP client cover the rest. Microsoft, which named the group, adds that it has been active since mid-2021, gets in through internet-facing Fortinet FortiGate devices, proxies its traffic through hacked SOHO routers and is, with moderate confidence, preparing to disrupt communications between the US and Asia during a future crisis. The HTML version of the advisory (AA23-144A) lists the exact command lines, which makes it a handy checklist for your own detection rules. One of the actor’s ntdsutil dumps went to C:\Windows\Temp\McAfee_Logs, which is a nice touch.