Chinese hackers Volt Typhoon are back, and rebuilding their botnet to target new victims

• Volt Typhoon is rapidly rebuilding its botnet of legacy routers
• Traffic is being obscured through webshells and MIPS-based malware
• Critical infrastructure needs to upgrade away from EOL devices

US allies and authorities recently dismantled parts of a network of legacy routers in small offices and home offices (SOHO) infected with the KV Botnet malware, used by the notorious Volt Typhoon group to target US critical infrastructure.

However, a huge new botnet targeting the same vulnerable legacy edge devices within critical infrastructure is rapidly growing, and Security Scorecard’s STRIKE Team thinks it is Volt Typhoon emerging from the ashes.

‘End-of-life’ (EOL) devices, those for which manufacturer support has ended, are again the main targets for this growing network.

SOHO and EOL devices

This time, Volt Typhoon has adapted to more effectively obscure its traffic using a number of tactics. By using SOHO and EOL devices, Volt Typhoon can maintain persistence within legacy routers without fear of security updates that could potentially boot them from their infrastructure. The group has also been spotted using MIPS-based malware to hide its connections and communications through port forwarding via 8433.

Webshells are also being implanted into routers to maintain remote control, which also disguise malicious traffic inside the router’s standard network operations. Many of these devices have been detected on the Pacific island of New Caledonia, acting as a transfer point for traffic coming from Volt Typhoon in the Asia-Pacific region heading into the US, and vice versa.

The prime targets of Volt Typhoon’s activities are Cisco RV320/325 and Netgear ProSafe routers….