Security News > 2023 > May > Five Eyes agencies detail how Chinese hackers breached US infrastructure

The National Security Agency and Five Eyes partner agencies have identified indicators of compromise associated with a People's Republic of China state-sponsored cyber actor dubbed Volt Typhoon, which is using living off the land techniques to target networks across US critical infrastructure.

The authoring agencies also includes a summary of indicators of compromise values, such as unique command-line strings, hashes, file paths, exploitation of CVE-2021-40539 and CVE-2021-27860 vulnerabilities, and file names commonly used by this actor.

As one of their primary tactics, techniques, and procedures of living off the land, the PRC actor uses tools already installed or built into a target's system.

This allows the actor to evade detection by blending in with normal Windows systems and network activities, avoiding endpoint detection and response products, and limiting the amount of activity that is captured in default logging configurations.

The NSA recommends network defenders apply the detection and hunting guidance in the cybersecurity advisory, such as logging and monitoring of command line execution and WMI events, as well as ensuring log integrity by using a hardened centralized logging server, preferably on a segmented network.

Defenders should also monitor logs for Event ID 1102, which is generated when the audit log is cleared.

News URL

https://www.helpnetsecurity.com/2023/05/25/volt-typhoon/