Procedure examples

Volt Typhoon has attempted to access hashed credentials from the LSASS process memory space.

Volt Typhoon has used ntds.util to create domain controller installation media containing usernames and password hashes.

Volt Typhoon has stolen files from a sensitive file server and the Active Directory database from targeted environments, and used Wevtutil to extract event log information.

Volt Typhoon has executed the Windows-native `vssadmin` command to create volume shadow copies.

Volt Typhoon has used `net start` to list running services.

Volt Typhoon has collected window title information from compromised systems.

Volt Typhoon has queried the Registry on compromised systems, `reg query hklm\software\`, for information on installed software including PuTTY.

Volt Typhoon has executed multiple commands to enumerate network topology and settings including `ipconfig`, `netsh interface firewall show all`, and `netsh interface portproxy show all`.

Volt Typhoon has employed Ping to check network connectivity.

Volt Typhoon has used multiple methods, including Ping, to enumerate systems on compromised networks.

Volt Typhoon has moved laterally to the Domain Controller via RDP using a compromised account with domain administrator privileges.

Volt Typhoon has used the Ultimate Packer for Executables (UPX) to obfuscate the FRP client files BrightmetricAgent.exe and SMSvcService.ex) and the port scanning utility ScanLine.

Volt Typhoon has used public tools and executed the PowerShell command `Get-EventLog security -instanceid 4624` to identify associated user and computer account names.

Volt Typhoon has used legitimate looking filenames for compressed copies of the ntds.dit database and used names including cisco_up.exe, cl64.exe, vm3dservice.exe, watchdogd.exe, Win.exe, WmiPreSV.exe, and WmiPrvSE.exe for the Earthworm and Fast Reverse Proxy tools.

Volt Typhoon has appended copies of the ntds.dit database with a .gif file extension.

Volt Typhoon has used commercial tools, LOTL utilities, and appliances already present on the system for network service discovery.

Volt Typhoon has leveraged WMIC for execution, remote system discovery, and to create and use temporary directories.

Volt Typhoon has used `netstat -ano` on compromised hosts to enumerate network connections.

Volt Typhoon has created and accessed a file named rult3uil.log on compromised domain controllers to capture keypresses and command execution.

Volt Typhoon has enumerated running processes on targeted systems including through the use of Tasklist.

Volt Typhoon has used PowerShell including for remote system discovery.

Volt Typhoon has used the Windows command line to perform hands-on-keyboard activities in targeted environments including for discovery.

Volt Typhoon has used Brightmetricagent.exe which contains a command- line interface (CLI) library that can leverage command shells including Z Shell (zsh).

Volt Typhoon has gained initial access by exploiting privilege escalation vulnerabilities in the operating system or network services.

Volt Typhoon has used commercial tools, LOTL utilities, and appliances already present on the system for group and user discovery.

Volt Typhoon has run `net localgroup administrators` in compromised environments to enumerate accounts.

Volt Typhoon has run `net group` in compromised environments to discover domain groups.

Volt Typhoon has run `rd /S` to delete their working directories and deleted systeminfo.dat from `C:\Users\Public\Documentsfiles`.

Volt Typhoon has inspected server logs to remove their IPs.

Volt Typhoon has staged collected data in password-protected archives.

Volt Typhoon has saved stolen files including the `ntds.dit` database and the `SYSTEM` and `SECURITY` Registry hives locally to the `C:\Windows\Temp\` directory.

Volt Typhoon relies primarily on valid credentials for persistence.

Volt Typhoon has used compromised domain accounts to authenticate to devices on compromised networks.

Volt Typhoon has enumerated directories containing vulnerability testing and cyber related content and facilities data such as construction drawings.

Volt Typhoon has executed `net user` and `quser` to enumerate local account information.

Volt Typhoon has run `net group /dom` and `net group "Domain Admins" /dom` in compromised environments for account discovery.

Volt Typhoon has used compromised devices and customized versions of open source tools such as FRP (Fast Reverse Proxy), Earthworm, and Impacket to proxy network traffic.

Volt Typhoon has used the built-in netsh `port proxy` command to create proxies on compromised systems to facilitate access.

Volt Typhoon has used multi-hop proxies for command-and-control infrastructure.

Volt Typhoon has downloaded an outdated version of comsvcs.dll to a compromised domain controller in a non-standard folder.

Volt Typhoon has used `netsh` to create a PortProxy Registry modification on a compromised server running the Paessler Router Traffic Grapher (PRTG).

Volt Typhoon has obtained a screenshot of the victim's system using the gdi32.dll and gdiplus.dll libraries.

Volt Typhoon has obtained victim's screen dimension and display device information.

Volt Typhoon has obtained the victim's system timezone.

Volt Typhoon has used VPNs to connect to victim environments and enable post-exploitation actions.

Volt Typhoon has used Base64-encoded data to transfer payloads and commands, including deobfuscation via certutil.

Volt Typhoon has gained initial access through exploitation of multiple vulnerabilities in internet-facing software and appliances such as Fortinet, Ivanti (formerly Pulse Secure), NETGEAR, Citrix, and Cisco.

Volt Typhoon has targeted the browsing history of network administrators.

Volt Typhoon has used native tools and processes including living off the land binaries or “LOLBins" to maintain and expand access to the victim networks.

Volt Typhoon has run system checks to determine if they were operating in a virtualized environment.