Joint Cybersecurity Advisory Volt Typhoon June 2023

Volt Typhoon has used ntds.util to create domain controller installation media containing usernames and password hashes.

Volt Typhoon has stolen files from a sensitive file server and the Active Directory database from targeted environments, and used Wevtutil to extract event log information.

Volt Typhoon has queried the Registry on compromised systems, `reg query hklm\software\`, for information on installed software including PuTTY.

Volt Typhoon has executed multiple commands to enumerate network topology and settings including `ipconfig`, `netsh interface firewall show all`, and `netsh interface portproxy show all`.

Volt Typhoon has used public tools and executed the PowerShell command `Get-EventLog security -instanceid 4624` to identify associated user and computer account names.

Volt Typhoon has used legitimate looking filenames for compressed copies of the ntds.dit database and used names including cisco_up.exe, cl64.exe, vm3dservice.exe, watchdogd.exe, Win.exe, WmiPreSV.exe, and WmiPrvSE.exe for the Earthworm and Fast Reverse Proxy tools.

Volt Typhoon has leveraged WMIC for execution, remote system discovery, and to create and use temporary directories.

Volt Typhoon has used `netstat -ano` on compromised hosts to enumerate network connections.

Volt Typhoon has used PowerShell including for remote system discovery.

Volt Typhoon has used the Windows command line to perform hands-on-keyboard activities in targeted environments including for discovery.

Volt Typhoon has run `net localgroup administrators` in compromised environments to enumerate accounts.

Volt Typhoon has saved stolen files including the `ntds.dit` database and the `SYSTEM` and `SECURITY` Registry hives locally to the `C:\Windows\Temp\` directory.

Volt Typhoon has run `net group /dom` and `net group "Domain Admins" /dom` in compromised environments for account discovery.

Volt Typhoon has used compromised devices and customized versions of open source tools such as FRP (Fast Reverse Proxy), Earthworm, and Impacket to proxy network traffic.

Volt Typhoon has queried the Registry on compromised systems for information on installed software.

Volt Typhoon has attempted to obtain credentials from OpenSSH, realvnc, and PuTTY.

Volt Typhoon has compromised small office and home office (SOHO) network edge devices, many of which were located in the same geographic area as the victim, to proxy network traffic.

Volt Typhoon has used `wevtutil.exe` and the PowerShell command `Get-EventLog security` to enumerate Windows logs to search for successful logons.

Volt Typhoon has discovered file system types, drive names, size, and free space on compromised systems.