Security researchers have identified Volt Typhoon deploying sophisticated techniques to compromise outdated Cisco RV320/325 and NetGear ProSafe routers, converting them into covert relay nodes for command-and-control operations. The Chinese state-sponsored hacking group known as Volt Typhoon has intensified its campaign targeting critical infrastructure across multiple countries through the exploitation of vulnerable Cisco and NetGear routers. For initial access, Volt Typhoon acquires credentials through various means, including phishing campaigns, credential dumping using tools like Mimikatz, and brute-forcing weak passwords on SOHO routers. Cyfirma Security analysts identified that despite a major FBI-led takedown of Volt Typhoon’s “KV Botnet” in December 2023, the group demonstrated remarkable resilience by swiftly rebuilding its network. Recent intelligence suggests that Volt Typhoon has maintained persistent access to some victim networks for as long as five years, highlighting their sophisticated capabilities and long-term strategic objectives. The group, also tracked under aliases including BRONZE SILHOUETTE, Dev-0391, and Vanguard Panda, has been targeting critical sectors including energy, water, transportation, and communications. The threat actor employs “living off the land” techniques, utilizing native system tools like PowerShell, Bash, wmic, and netsh to execute commands while avoiding the deployment of custom malware. Once inside a network, they establish persistence by creating scheduled tasks or cron jobs, and leverage compromised routers as “silent bridges” for their command infrastructure. The group recently exploited a zero-day vulnerability (CVE-2024-39717) in Versa Networks SD-WAN in June 2024, deploying a custom web shell called VersaMem to intercept credentials and pivot into downstream customer networks. This advanced persistent threat (APT) actor has been conducting widespread espionage and pre-positioning for potential disruptive attacks, particularly focusing on organizations in the United States and allied nations. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis.
This Cyber News was published on cybersecuritynews.com. Publication date: Mon, 17 Mar 2025 14:35:07 +0000