Hiding in Plain Sight: Hunting Volt Typhoon Cyber Actors
summary
Chinese Volt Typhoon actors quietly pre-position on US critical networks for disruption, using living-off-the-land tools like Fast Reverse Proxy (FRP), credential theft with Mimikatz and periodic export of NTDS.dit to reuse domain credentials. Investigation links compromises from Guam into wider US sectors, spawns a May 2023 hunt guide and a February CSA, and prompts a technical operation — a KV-Botnet removal under Rule 41 — plus collaboration with 11 industry partners to speed victim notifications.
AI-written summary · about
chapters (24)
- 0:00Introduction
- 1:04Volt Typhoon threat overview
- 2:29Microsoft’s early discovery
- 3:33NSA tracking infrastructure
- 5:59CISA Guam investigation
- 7:26FBI forensic findings
- 11:42US government collaboration
- 13:46Microsoft’s blog post urgency
- 15:32Post-advisory actions impact
- 17:40Inter-agency threat hunting
- 20:08Victim notification coordination
- 22:35Detecting invisible adversaries
- 24:58Log retention visibility gaps
- 26:43Volt Typhoon vs other PRC actors
- 28:10FBI KV-Botnet operation
- 31:01CISA 2024 detection patterns
- 35:19Best practices for detection
- 37:26Nation-State APT audits
- 38:52Collaboration for defense
- 39:54Incident response prep
- 40:16Volt Typhoon long-term threat
- 41:21Strategic resilience
- 43:28AI in cyber threats
- 43:48FBI disrupting obfuscation
related talks
28mForecasting Typhoons: Volt Typhoon Next Steps in OT Disruption
25mGlobal Threat Brief: Hacks and Adversaries Unveiled
49mConducting a Successful False Flag Cyber Operation (Blame it on China)
29mCritical Infrastructure Network Attacks: Code Red, Alert Network Operators
32mOperation Clairvoyance: How APT Groups Spy on the Media Industry
09mDisrupting Cyber Adversaries: Meta's Approach to Deterrence
55mRevealing the Attack Operations Targeting Japan
42mKeynote: The Expanding Universe of Cyber Threats