[ad_1]
\n<\/p>\n
Volt Typhoon, active since 2021, has targeted critical infrastructure providers in the U.S. and Guam, according to Microsoft researchers. The major industries targeted by the actor include communications, manufacturing, utilities, transportation, construction, IT, education and government.\u00a0<\/p>\n
\u201cAdversaries frequently target critical infrastructure to perform reconnaissance and eventually gain a foothold in the event of an escalation in tension, or in the worst case war, the adversary can disable parts of a country\u2019s infrastructure,\u201d Tom Winston, director of intelligence content at Dragos, said via email.\u00a0<\/p>\n
Researchers from Mandiant said they recognize the hackers from prior campaigns involving air, maritime and land transportation targets. The new activity could be in preparation for disruptive or destructive cyberattacks.\u00a0<\/p>\n
\u201cPreparation does not mean attacks are inevitable,\u201d said John Hultquist, chief analyst, Mandiant Intelligence, Google Cloud. \u201cStates conduct long-term intrusions into critical infrastructure to prepare for possible conflict, because it simply may be too late to gain access when conflict arises.\u201d<\/p>\n
Microsoft said it has directly notified customers who were targeted or compromised.\u00a0<\/p>\n
After gaining access through the Fortinet devices, the hackers try to leverage any privilege from those devices and then remove credentials over to an Active Directory account, according to Microsoft. The credentials are then used to authenticate to other devices. Fortinet officials could not be immediately reached for comment.<\/p>\n
Microsoft researchers said detecting and mitigating the attacks will be challenging due to the actor\u2019s reliance on active accounts and living-off-the-land binaries. The NSA has published a guide to detect and mitigate living-off-the-land activity<\/a>.<\/p>\n<\/p><\/div>\n