Chinese Volt Typhoon APT Targets US Entities
The Chinese nation-state actor known as Volt Typhoon, also referred to as Bronze Silhouette, has recently been discovered to be actively conducting cyber espionage operations since mid-2020. The group, identified by cybersecurity company CrowdStrike as Vanguard Panda, has exhibited sophisticated tradecraft to maintain prolonged access to their targeted organizations.
According to CrowdStrike's findings, Volt Typhoon has consistently utilized ManageEngine Self-service Plus exploits as their initial entry point, followed by custom web shells to ensure persistent access. They have also employed living-off-the-land techniques for lateral movement within the compromised networks.
Volt Typhoon Targets Organizations in the US
The primary targets of Volt Typhoon's cyber intrusion operations have been the U.S. government, defense entities, and critical infrastructure organizations. Their tactics prioritize operational security, relying on a comprehensive range of open-source tools to carry out long-term malicious activities against a limited number of victims.
The group has demonstrated a preference for using web shells for persistence and relies on living-off-the-land binaries in short bursts of activity to achieve their objectives. In a specific incident targeting an undisclosed customer, Vanguard Panda leveraged the Zoho ManageEngine ADSelfService Plus service running on an Apache Tomcat server to execute suspicious commands related to process enumeration and network connectivity.
CrowdStrike's analysis of Tomcat access logs revealed HTTP POST requests to /html/promotion/selfsdp.jspx, a web shell disguised as a legitimate identity security solution to evade detection. This web shell had likely been deployed months before the actual attack, indicating extensive reconnaissance of the target network.
Vulnerability Likely Attack Vector for the Chinese APT
While the exact method used by Vanguard Panda to breach the ManageEngine environment remains unclear, evidence points to the exploitation of CVE-2021-40539, a critical authentication bypass vulnerability that allows for remote code execution. The threat actor attempted to conceal their tracks by deleting artifacts and tampering with access logs, but their attempt fell short, leading to the discovery of additional web shells and backdoors.
One of these discoveries includes a JSP file obtained from an external server, which backdoors the "tomcat-websocket.jar" file by utilizing a related JAR file called "tomcat-ant.jar." The trojanized version of tomcat-websocket.jar includes three new Java classes (A, B, and C), with A.class serving as yet another web shell capable of executing Base64-encoded and AES-encrypted commands.
