Volt Typhoon returns with fresh botnet attacks on critical US infrastructure – Source: www.csoonline.com

Volt Typhoon, a China-linked cyber-espionage group, has renewed its assault on US infrastructure through an advanced botnet operation, exploiting outdated Cisco and Netgear routers to breach critical networks.

Volt Typhoon’s tactics mark a sophisticated escalation, as its hackers leverage end-of-life routers that no longer receive security updates, according to SecurityScorecard’s recent report.

This renewed activity comes nearly ten months after US authorities dismantled parts of the group’s botnet, which had initially targeted US energy, water, and telecommunications networks.

The DOJ then claimed that the authorities had “removed the malware from US-based victim routers and taken steps to prevent reinfection.”

“The Justice Department has disrupted a PRC-backed hacking group that attempted to target America’s critical infrastructure utilizing a botnet,” Attorney General Merrick B. Garland had said referring to Volt Typhoon.

However, the Volt Typhoon has returned with new vigor, as per the researchers at SecurityScorecard.

“Once thought dismantled, Volt Typhoon has returned, more sophisticated and determined than ever,” Ryan Sherstobitoff, SVP of threat research at SecurityScorecard said in the report.

Sherstobitoff’s team has identified Volt Typhoon exploiting Cisco RV320/325 routers and Netgear ProSafe devices, often overlooked due to their legacy status.

“These end-of-life devices become perfect entry points,” he noted, explaining that within 37 days, the attackers compromised around 30% of visible Cisco RV320/325 routers.

The modus operandi

Volt Typhoon’s strategy is defined by its resilience and adaptability. Instead of retreating when detected, the group intensifies its foothold, exploiting long-overlooked vulnerabilities in legacy Cisco RV320/325 and Netgear ProSafe routers.

The PRC-backed hackers’ botnet infrastructure is built to avoid detection. They use servers across Europe and Asia-Pacific to mask their command-and-control (C2) operations. The group’s strategy includes hiding traffic through network providers in countries such as the Netherlands, Latvia, and Germany, the report said.

“Every layer of Volt Typhoon’s infrastructure is designed to blend malicious activities into everyday operations, making them difficult to detect and even harder to remove — especially in sectors like governments and critical infrastructure that still depend on outdated technology,” the report added.

The research firm’s STRIKE team revealed that Volt Typhoon’s botnet spans global networks, using the JDYFJ SSL certificate cluster for encrypted, untraceable communication.

Masking their traffic through C2 servers in Europe, the botnet evades detection with encryption tactics that effectively mimic regular network operations. The group’s malicious infrastructure incorporates a VPN device in New Caledonia, forming a “bridge” between Asia-Pacific and the Americas, allowing their network to quietly thrive, the report added.

The unrelenting Volt Typhoon

SecurityScorecard’s findings follow a string of recent revelations highlighting the broader uptick in Chinese cyber-espionage activities.

Last week, Volt Typhoon had reportedly breached Singapore Telecommunications as a prelude to further intrusions targeting US telecoms. Additionally, in August, Lumen Technologies reported that Volt Typhoon used a Versa SD-WAN vulnerability (CVE-2024-39717) to plant credential-stealing web shells in compromised networks.

In February, US cybersecurity officials, along with their allies in Australia, Canada, the UK, and New Zealand, issued a joint warning regarding Volt Typhoon. They expressed concerns that the group may intensify cyberattacks on critical infrastructure in the event of heightened tensions between Beijing and Washington. The warning emphasizes the group’s capability and readiness to disrupt vital systems, with potential implications for national security and global cybersecurity stability.