The group compromised IT environments - primarily across communications, energy, transportation systems, and water and wastewater system sectors - in the continental and non-continental United States and its territories, including Guam.
According to the US agencies, Volt Typhoon will likely use this network access for disruptive attacks in the event of geopolitical tensions or military conflicts.
In addition to sounding the alarm, the governments issued a long list of technical details, TTPs observed in the digital break-ins, and detection recommendations and best practices.
These include: apply patches for internet-facing systems with priority given to appliances that Volt Typhoon likes to exploit.
Second: turn on phishing-resistant multi-factor authentication.
Finally, ensure that logging is turned on for applications, access and security logs, and store these logs in a centralized system.
This Cyber News was published on go.theregister.com. Publication date: Wed, 07 Feb 2024 19:43:03 +0000