The IT Nerd

Heads up. There was a joint cybersecurity advisory issued by the US today that Volt Typhoon has infiltrated and existed in critical infrastructure networks for at least five years. This link is a TL:DR of that joint advisory. This somewhat echoing an analysis by Microsoft from almost a year ago.

Ken Westin, Field CISO, Panther Labs had this comment:

The methods being utilized by Volt Typhoon, although not new, should be cause for concern given their intent and targets. Unlike ransomware operators whose goal is to get in and cause damage quickly, this nation-state operator is leveraging valid accounts and “living off the land” techniques to evade detection for long periods of time. These methods allow the group to monitor their targets and provide a foothold to cause kinetic damage — damage that can affect equipment and pose a physical threat to critical infrastructure. By targeting energy, water, communications and transportation infrastructure, it is apparent that Volt Typhoon is seeking to disrupt operations of critical infrastructure to cause panic, discord and distract leadership and the public. Many of the OT environments being targeted are notorious for running outdated software, either out of negligence or necessity, if the systems cannot be updated, which increases the risk posed by this threat.

This is another one of those wake up calls that everyone needs to heed as the PRC who are the ones behind Volt Typhoon are serious about their aims to get into networks and steal data. That makes keeping them out a top priority.

UPDATE: Damir J. Brescic, CISO, Inversion6 adds this comment:

This development represents a significant escalation in something warned last year — the underscoring of the sophisticated capabilities of APT (Advanced Persistent Threat) groups.

Volt Typhoon is known for targeting critical infrastructures, government facilities, and the manufacturing sector. Oh, did I mention that they are a Chinese-sponsored hacking group?

The group operations demonstrate a deep understanding of network defense and evasion techniques that allow them to remain undetected for extended periods of time. Their TTP’s (Tactics, Techniques, and Procedures) point to their technical expertise and resources typically found with state-sponsored APT groups.

Their presence is a warning call, highlighting the need for proactive cybersecurity measures, continuous monitoring and sharing of information among various stakeholders. I believe the Volt Typhoon poses a significant risk to critical infrastructure networks – underscoring the need for robust cybersecurity measures across industries and government partners.

I have to admit that this has stunned me as the conventional thinking is that you don’t pay threat actors to get your data back. But apparently there are plenty of people don’t buy into that as this report states that ransomware payments exceed $1 Billion in 2023:

In 2023, ransomware actors intensified their operations, targeting high-profile institutions and critical infrastructure, including hospitals, schools, and government agencies. Major ransomware supply chain attacks were carried out exploiting the ubiquitous file transfer software MOVEit, impacting companies ranging from the BBC to British Airways. As a result of these attacks and others, ransomware gangs reached an unprecedented milestone, surpassing $1 billion in extorted cryptocurrency payments from victims.

And:

2023 marks a major comeback for ransomware, with record-breaking payments and a substantial increase in the scope and complexity of attacks — a significant reversal from the decline observed in 2022, which we forewarned in our Mid-Year Crime Update.

 Ken Westin, Field CISO, Panther Labs had this comment:

The fact the numbers have increased this year shouldn’t be surprising. Ransomware groups operating in Russia were emboldened by the Ukraine conflict and many ransomware groups removed a lot of restrictions they previously had regarding targeting of schools, government agencies and critical infrastructure. The exploitation of software vulnerabilities such as MOVEit has also played a devastating role in the compromise of companies and institutions. Many IT departments were unaware the tool was running in their environments. In addition to the money paid to ransomware gangs, there is also the increasing cost of damage imposed by ransomware on organizations that don’t pay the ransom.

This has to serve as a wake up call that all of us can no longer sleepwalk though this ransomware crisis. Everyone needs to take action. Every part of a defensive playbook from detection, remediation, and a no paying threat actors policy needs to be on the table and acted upon. Because this is the only way to stop this crisis.