Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Threat Brief: Attacks on Critical Infrastructure Attributed to Insidious Taurus (Volt Typhoon)

Summary: Insidious Taurus, also known as Volt Typhoon and attributed by U.S. and international government agencies to PRC state sponsorship, pre-positions itself inside U.S. critical infrastructure IT networks, likely to enable disruptive or destructive attacks during a major crisis or conflict. FBI director Christopher Wray called the group "the defining threat of our generation" in a Jan. 31, 2024 House hearing, and the U.S. Department of Justice announced that same day that a court-authorized operation disrupted a botnet of hundreds of U.S.-based SOHO devices, most of them unsupported routers, that the group had used.

Bottom line: The KV-botnet disruption did not end the threat: the group remains active, and its reliance on living-off-the-land tools, hands-on-keyboard activity, and compromised end-of-support routers means its traffic resembles legitimate administration and leaves few signatures to detect.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Threat Actors & Nation-State
Mentions
CVE-2021-40539
Related