Microsoft Volt Typhoon May 2023

Volt Typhoon has attempted to access hashed credentials from the LSASS process memory space.

Volt Typhoon has used ntds.util to create domain controller installation media containing usernames and password hashes.

Volt Typhoon has used multiple methods, including Ping, to enumerate systems on compromised networks.

Volt Typhoon has leveraged WMIC for execution, remote system discovery, and to create and use temporary directories.

Volt Typhoon has enumerated running processes on targeted systems including through the use of Tasklist.

Volt Typhoon has used PowerShell including for remote system discovery.

Volt Typhoon has used the Windows command line to perform hands-on-keyboard activities in targeted environments including for discovery.

Volt Typhoon has staged collected data in password-protected archives.

Volt Typhoon has used compromised domain accounts to authenticate to devices on compromised networks.

Volt Typhoon has used compromised devices and customized versions of open source tools such as FRP (Fast Reverse Proxy), Earthworm, and Impacket to proxy network traffic.

Volt Typhoon has used the built-in netsh `port proxy` command to create proxies on compromised systems to facilitate access.

Volt Typhoon has run system checks to determine if they were operating in a virtualized environment.

Volt Typhoon has compromised small office and home office (SOHO) network edge devices, many of which were located in the same geographic area as the victim, to proxy network traffic.

Volt Typhoon has used legitimate network and forensic tools and customized versions of open-source tools for C2.

Volt Typhoon has discovered file system types, drive names, size, and free space on compromised systems.