Secureworks BRONZE SILHOUETTE May 2023

Volt Typhoon has used ntds.util to create domain controller installation media containing usernames and password hashes.

Volt Typhoon has stolen files from a sensitive file server and the Active Directory database from targeted environments, and used Wevtutil to extract event log information.

Volt Typhoon has used multiple methods, including Ping, to enumerate systems on compromised networks.

Volt Typhoon has used public tools and executed the PowerShell command `Get-EventLog security -instanceid 4624` to identify associated user and computer account names.

Volt Typhoon has used legitimate looking filenames for compressed copies of the ntds.dit database and used names including cisco_up.exe, cl64.exe, vm3dservice.exe, watchdogd.exe, Win.exe, WmiPreSV.exe, and WmiPrvSE.exe for the Earthworm and Fast Reverse Proxy tools.

Volt Typhoon has appended copies of the ntds.dit database with a .gif file extension.

Volt Typhoon has leveraged WMIC for execution, remote system discovery, and to create and use temporary directories.

Volt Typhoon has used `netstat -ano` on compromised hosts to enumerate network connections.

Volt Typhoon has enumerated running processes on targeted systems including through the use of Tasklist.

Volt Typhoon has used the Windows command line to perform hands-on-keyboard activities in targeted environments including for discovery.

Volt Typhoon has run `net group` in compromised environments to discover domain groups.

Volt Typhoon has run `rd /S` to delete their working directories and deleted systeminfo.dat from `C:\Users\Public\Documentsfiles`.

Volt Typhoon has inspected server logs to remove their IPs.

Volt Typhoon has saved stolen files including the `ntds.dit` database and the `SYSTEM` and `SECURITY` Registry hives locally to the `C:\Windows\Temp\` directory.

Volt Typhoon has used compromised domain accounts to authenticate to devices on compromised networks.

Volt Typhoon has run `net group /dom` and `net group "Domain Admins" /dom` in compromised environments for account discovery.

Volt Typhoon has used Base64-encoded data to transfer payloads and commands, including deobfuscation via certutil.

Volt Typhoon has gained initial access through exploitation of multiple vulnerabilities in internet-facing software and appliances such as Fortinet, Ivanti (formerly Pulse Secure), NETGEAR, Citrix, and Cisco.

Volt Typhoon has used webshells, including ones named AuditReport.jspx and iisstart.aspx, in compromised environments.

Volt Typhoon has archived the ntds.dit database as a multi-volume password-protected archive with 7-Zip.

Volt Typhoon has copied web shells between servers in targeted environments.

Volt Typhoon has used a version of the Awen web shell that employed AES encryption and decryption for C2 communications.

Volt Typhoon has used compromised Paessler Router Traffic Grapher (PRTG) servers from other organizations for C2.

Volt Typhoon has discovered file system types, drive names, size, and free space on compromised systems.