Typhoon-like gang slinging TLS certificate ‘signed’ by the Los Angeles Police Department – Source: go.theregister.com

A stealthy, ongoing campaign to gain long-term access to networks bears all the markings of intrusions conducted by China’s ‘Typhoon’ crews and has infected at least 1,000 devices, primarily in the US and South East, according to Security Scorecard’s Strike threat intel analysts. And it uses a phony certificate purportedly signed by the Los Angeles police department to try and gain access to critical infrastructure.

The digital break-ins began no later than September 2023 (maybe earlier) and have expanded ever since. The campaign mostly targets end-of-life routers, IoT devices, internet-connected security cameras, virtual servers, and other small office/home office (SOHO) devices, with the goal of building an Operational Relay Box or ORB network.

Beijing’s attackers route traffic and launch cyberattacks through these ORB networks, which have grown to hundreds or thousands of compromised devices. Because the activity comes through what seems to be a local IP address, it’s harder to track. In recent years, essentially all of the Chinese government-backed groups use ORBs to remain undetected on victims’ networks.

Our hypothesis: It’s the Typhoons — Volt Typhoon, Salt Typhoon. These are the TTPs associated with those actors, especially when it comes to operational relay boxes and then using them as a covert transfer network

“It’s a technique that nation-state adversaries, particularly Volt Typhoon, uses as a way of transferring their traffic and obfuscating their activity,” Security Scorecard field chief threat intelligence officer Ryan Sherstobitoff told The Register. “They’ll use ORB boxes, usually in the last mile of or close proximity to their targets, and be able to then launch attacks coming from those ORB boxes to the targets so it looks like it’s within the same geographical area.”

Victims include internet service providers, hardware vendors, and organizations in several sectors, including IT, networking, real estate, and media. Five geographic regions — the US (352 victims), Japan (256 victims), South Korea (226 victims), Taiwan (80 victims), and Hong Kong (37 victims) — make up about 90 percent of the entire ORB network.

While Security Scorecard can’t definitely attribute this network to a particular Chinese government hacking group, “our hypothesis,” according to Sherstobitoff: “It’s the typhoons – Volt Typhoon, Salt Typhoon. These essentially are the TTPs [tactics, techniques, and procedures] associated with those type of actors, especially when it comes to operational relay boxes and then using them as a covert transfer network.”

Meet LapDogs

Intruders built this ORB network, which Security Scorecard named “LapDogs,” by compromising old and unpatched devices through a variety of means. The miscreants “appear to favor targeting Linux-based systems in their operations,” according to a report published Monday.

Almost 55 percent (587) of the 1,000 compromised devices are Ruckus Wireless access point devices, while Buffalo Technology AirStation wireless routers (107) were also prevalent among infected gear.

Several of the infected devices were vulnerable to CVE-2015-1548 and CVE-2017-17663, two vulnerabilities in older versions of ACME mini_httpd, a small, lightweight web server developed by ACME Laboratories. CVE-2015-1548 allows remote attackers to obtain sensitive information from process memory, and CVE-2017-17663 is a buffer overflow flaw that attackers can exploit to achieve remote code execution.

However, the intruders will exploit “any kind of vulnerability that is open on these devices,” Sherstobitoff said.

After they’ve broken in, the suspected Chinese snoops deploy a custom backdoor called ShortLeash to maintain access to the compromised devices and build this interconnected network of covert boxes.

Upon execution, ShortLeash generates a self-signed, TLS certificate that presents as if signed by the City of Los Angeles Police Department (LAPD). That name suggests those behind the campaign are attempting to spoof the police department to appear legitimate. It also gave the ORB network its name: LapDogs.

Once the devices are infected and tethered together with ShortLeash, the attackers push a malicious payload and a startup Bash script to execute it.

The startup Bash script assesses the privileges of the local user, insists on running as a root-level user, and then checks the operating system so it can target the relevant folder based on the OS architecture: /etc/systemd/system/ in Ubuntu and /lib/systemd/system/ in CentOS.

If the script isn’t running in those two OSes, it prints a message in Mandarin that translates to “Unknown System.”

If it us running in Ubuntu or CentOS, the script drops the malware, and also creates a backup of the ShortLeash backdoor that continues running in the background. That backdoor has root-level privileges and reloads every time the device reboots, which allows the attackers to achieve persistent access to an infected machine.

The purpose of the malware itself is not known – it’s encrypted, and Security Scorecard said it requires further analysis. However, the company’s research notes that it matches another malware sample spotted by Cisco Talos, which saw it targeting critical infrastructure in Taiwan. One likely possibility is that the ORB will deploy the malware to shut down or disrupt critical infrastructure in a future attack.

• Chinese spy crew appears to be preparing for conflict by backdooring 75+ critical orgs
• Why is China deep in US networks? ‘They’re preparing for war,’ HR McMaster tells lawmakers
• More victims of China’s Salt Typhoon crew emerge: Telcos just now hit via Cisco bugs
• This is the FBI, open up. China’s Volt Typhoon is on your network

While the ORB’s operators have taken several steps to hide their malware-dropping traffic, Sherstobitoff said defenders can protect their networks.

“From a defender’s point of view, it’s understanding the activity, understanding the TTPs,” he said, referring to the Tactics, Techniques, and Procedures that threat groups use when executing an attack.

In this case: routers and other home devices infected with ShortLeash and attempting to communicate with critical infrastructure networks from a high-numbered, uncommon internet port, presenting the fake LAPD security certificate, via encrypted traffic, should set off alarm bells.

“Suspicious connections coming from home devices that normally don’t connect to your network something to be aware of,” Sherstobitoff said. “So imagine: Traffic coming from a Spectrum IP address space, which is residential, and having connections coming from that at high port levels, encrypted – it’s something weird.” ®