Volt Typhoon: Inside China’s Covert Cyber Operations on Critical Infrastructure

In an era where cyber threats increasingly resemble acts of silent warfare, the case of Volt Typhoon serves as a stark reminder of how advanced and persistent adversaries can infiltrate core infrastructure without setting off alarms. This state-sponsored campaign—attributed to China—used stealthy, almost surgical methods to establish long-term access to sectors that form the backbone of society.

What Is Volt Typhoon?

First revealed in May 2023 by Microsoft and CISA, Volt Typhoon is a cyber espionage campaign targeting critical infrastructure in the United States and allied countries. But unlike ransomware groups or defacement attacks, Volt Typhoon didn’t aim for chaos—it aimed for silence and control.

Its targets included:

• Communications providers

• Maritime and transportation systems

• IT and managed service providers

• Utility companies

• Manufacturers supporting national logistics

This was espionage, not sabotage. The attackers didn’t crash systems—they embedded themselves quietly, preparing for possible future operations, potentially in times of geopolitical tension or conflict.

How Volt Typhoon Works: Living Off the Land with Precision

Volt Typhoon didn’t use custom malware or obvious backdoors. Instead, it relied on a technique called Living off the Land (LotL)—leveraging legitimate tools and commands already built into operating systems. This strategy made detection extremely difficult.

1. Initial Access: Exploiting Internet-Facing Devices

The campaign began with the compromise of vulnerable SOHO (Small Office/Home Office) routers and firewalls. Brands like ASUS, Cisco, D-Link, and Netgear were among the affected, although any device with outdated firmware or unpatched security flaws was at risk.

Attackers scanned for internet-facing management interfaces—often misconfigured or left exposed—and used these as entry points. Once in, they rerouted malicious traffic through these devices, effectively masking it as legitimate. This proxying technique:

• Obscured the true origin of the attacks

• Reduced the need for dedicated attacker infrastructure

• Made detection and attribution significantly harder

Mitigation tip: Ensure router/firewall management interfaces are not exposed to the internet and are protected by strong authentication.

2. Covert Data Tunneling with Earthworm and Custom Proxies

Once inside, Volt Typhoon established stealthy communications using tools like Earthworm, a legitimate proxy tunneling tool. This allowed attackers to:

• Bypass traditional firewall rules

• Send and receive data without detection

• Maintain remote access for extended periods

They also employed custom-modified versions of Impacket and Fast Reverse Proxy (FRP) to build flexible command-and-control channels over compromised systems. In some cases, they even set up local proxies on infected machines using native OS tools—no malware required.

To further avoid detection, they mimicked legitimate users, using stolen credentials to blend into normal network traffic.

3. Credential Dumping and Privilege Escalation

To expand access and move laterally through networks, Volt Typhoon focused heavily on credential harvesting. Two key methods stood out:

• PowerShell Memory Dumping:
  Using base64-encoded PowerShell commands, attackers ran tools like rundll32.exe and comsvcs.dll to pull credentials directly from system memory.

• Active Directory Extraction:
  They utilized WMIC and NTDSUtil to dump the ntds.dit file—essentially the password vault for a Windows domain. With offline cracking tools, they could then extract all user hashes and create hidden admin accounts.

Additionally, attackers mapped the internal environment by:

• Scanning active processes and open connections

• Probing drive types, sizes, and usage

• Detecting whether they were inside a virtual machine

• Exploring the network using ping, PowerShell, and WMI scripts

This careful surveillance enabled them to maintain control while remaining nearly invisible.

Detection and Defense Strategies

Detecting LotL techniques requires behavioral analysis rather than signature-based detection. Here’s how organizations can respond:

1. Turn On and Monitor Key Windows Logs

Many essential logs are disabled by default in Windows. Enabling them is step one.

• 4688 & 4689: Track process creation and termination

• 4672: Privileged account logins

• 4648: Use of explicit credentials (manual logins)

• PowerShell 400 & 403: Monitor script execution

Ironically, Volt Typhoon used Event ID 4624 to watch for admin logins before escalating privileges.

2. Network Anomaly Detection

LotL attackers avoid traditional malware signatures, so look for behavioral red flags:

• Unusual outbound traffic to unknown IPs

• Unexpected internal device communication

• Open ports not typically in use

• Earthworm-style proxy tunnels

Tip: YARA rules can help flag known tunneling activity, including Earthworm and modified FRP.

3. Proactive Threat Hunting and EDR Tools

Standard antivirus won’t catch Volt Typhoon. Instead, focus on:

• Baseline monitoring for deviations in network behavior

• Detecting encoded PowerShell commands or WMI abuse

• Identifying native tool misuse (e.g., rundll32, comsvcs.dll)

EDR (Endpoint Detection and Response) platforms play a critical role here. Benefits include:

• Real-time behavioral monitoring

• Immediate threat containment

• Visibility into lateral movement and persistence

• Automated remediation of artifacts

• Integration with threat intelligence feeds for adaptive defenses

Understanding Indicators of Compromise (IOCs)

To catch Volt Typhoon early, watch for known file hashes linked to the group. Here are examples of SHA-256 hashes used in their custom executables:

• baeffeb5fdef2f42a752c65c2d2a52e84fb57efc906d981f89dd518c314e231c

• b4f7c5e3f14fb57be8b5f020377b993618b6e3532a4e1eb1eae9976d4130cc74

• c0fc29a52ec3202f71f6378d9f7f9a8a3a10eb19acb8765152d758aded98c76d

Regularly update detection rules to include new IOCs as they emerge. These act like digital fingerprints—unique identifiers that reveal the presence of malicious files.

Final Thoughts: Staying Ahead of Stealth Attacks

Volt Typhoon is a textbook example of how stealth, patience, and misuse of legitimate tools can make even highly protected networks vulnerable. Defenders need to look beyond malware and start thinking in terms of user behavior, tool misuse, and subtle changes to baseline operations.

To reduce risk:

• Harden network infrastructure and close exposed interfaces

• Monitor for abnormal login patterns and PowerShell activity

• Use EDR solutions to catch non-signature-based threats

• Review and rotate potentially compromised credentials

In modern cyber conflict, the quietest threats are often the most dangerous.