Government agencies in the US, UK, Canada, Australia, and New Zealand are warning critical infrastructure entities of the threat posed by Volt Typhoon, a Chinese state-sponsored group that hacked thousands of organizations worldwide.
Following a February CISA advisory on Volt Typhoon pre-positioning itself in critical infrastructure organizations’ networks for disruption or destruction purposes, the Five Eyes agencies are now providing guidance on how critical infrastructure entities can defend against the threat.
The advanced persistent threat (APT) actor successfully hacked US communications, energy, transportation systems, and water and wastewater organizations, the Five Eyes advisory (PDF) notes.
To defend against the risk associated with Volt Typhoon, leaders of critical infrastructure entities should empower cybersecurity teams to make informed resourcing decisions, including by using intelligence-informed prioritization tools, the agencies say.
They should also empower cybersecurity teams to effectively apply detection and hardening best practices, receive continuous cybersecurity training and skill development, and develop comprehensive information security plans.
“Volt Typhoon does not rely on malware to maintain access to networks and conduct their activity. Rather, they use built-in functions of a system. This technique, known as ‘living off the land,’ enables them to easily evade detection. To protect against living off the land, organizations need a comprehensive and multifaceted approach,” the advisory reads.
Smaller organizations that do not have a cybersecurity team should obtain managed security services, the Five Eyes agencies say.
Organizations are also advised to secure their supply chain by establishing strong vendor risk management processes, ensuring due diligence is exercised for procurement, ensuring vendors enable interoperability as a best practice, and identifying and limiting the use of products that break the principle of least privilege.
The guidance also recommends implementing incident response plans and reviewing and updating them regularly, and immediately reporting incidents to one of the authoring agencies.
Critical infrastructure organization leaders are urged to read the guidance and apply the recommendations to defend against Volt Typhoon and similar threats.
Related: US Gov Disrupts SOHO Router Botnet Used by Chinese APT Volt Typhoon
Related: China-Linked Volt Typhoon Hackers Possibly Targeting Australian, UK Governments
