Chinese hackers Volt Typhoon are back, and rebuilding their botnet to target
new victims

Date:
Wed, 13 Nov 2024 11:22:12 +0000

Description:
Legacy devices are again being hijacked by Volt Typhoon to target critical
infrastructure and governmental departments.

FULL STORY

US allies and authorities recently dismantled parts of a network of legacy
routers in small offices and home offices (SOHO) infected with the KV Botnet
malware, used by the notorious Volt Typhoon group to target US critical
infrastructure. 

However, a huge new botnet targeting the same vulnerable legacy edge devices
within critical infrastructure is rapidly growing, and Security Scorecards
STRIKE Team thinks it is Volt Typhoon emerging from the ashes. 

End-of-life (EOL) devices, those for which manufacturer support has ended, 
are again the main targets for this growing network.

SOHO and EOL devices 

This time, Volt Typhoon has adapted to more effectively obscure its traffic
using a number of tactics. By using SOHO and EOL devices, Volt Typhoon can
maintain persistence within legacy routers without fear of security updates
that could potentially boot them from their infrastructure. The group has 
also been spotted using MIPS-based malware to hide its connections and
communications through port forwarding via 8433. 

Webshells are also being implanted into routers to maintain remote control,
which also disguise malicious traffic inside the router's standard network
operations. Many of these devices have been detected on the Pacific island of
New Caledonia, acting as a transfer point for traffic coming from Volt 
Typhoon in the Asia-Pacific region heading into the US, and vice versa. 

The prime targets of Volt Typhoons activities are Cisco RV320/325 and Netgear
ProSafe routers. Software maintenance releases and bug fixes for the Cisco
RV320/325 ended in 2021, with STRIKE Team highlighting that Volt Typhoon
compromised 30% of visible Cisco RV320/325 routers in just 37 days, with
government and critical infrastructure being prime targets. 

STRIKE Team recommends that government departments should address weaknesses
such as the use of legacy devices within critical infrastructure to reduce 
the number of potential vulnerabilities and access points for cyber criminal
organizations and state-sponsored groups.

======================================================================
Link to news story:
https://www.techradar.com/pro/chinese-hackers-volt-typhoon-are-back-and-rebuil
ding-their-botnet-to-target-new-victims

$$
--- SBBSecho 3.20-Linux