Skip to main content

We use cookies to ensure you get the best user experience. For more information see our cookie policy.

Volt Typhoon

Investigate a suspected intrusion by the notorious APT group Volt Typhoon.

Task 1: IR Scenario

Volt Typhoon

Scenario: The SOC has detected suspicious activity indicative of an advanced persistent threat (APT) group known as Volt Typhoon, notorious for targeting high-value organizations. Assume the role of a security analyst and investigate the intrusion by retracing the attacker's steps.

You have been provided with various log types from a two-week time frame during which the suspected attack occurred. Your ability to research the suspected APT and understand how they maneuver through targeted networks will prove to be just as important as your Splunk skills. 

Connect to OpenVPN or use the AttackBox to access Splunk. Please give the machine about 4 minutes to boot.

Splunk Credentials
Username: volthunter
Password: voltyp1010
Splunk URL: http://MACHINE_IP:8000

Answer the questions below

  1. I understand my duties and have started the attached lab machine.

Task 2: Initial Access

Initial Access

Volt Typhoon often gains initial access to target networks by exploiting vulnerabilities in enterprise software. In recent incidents, Volt Typhoon has been observed leveraging vulnerabilities in Zoho ManageEngine ADSelfService Plus, a popular self-service password management solution used by organizations.

Answer the questions below

  1. Comb through the ADSelfService Plus logs to begin retracing the attacker’s steps. At what time (ISO 8601 format) was Dean's password changed and their account taken over by the attacker?

  2. Shortly after Dean's account was compromised, the attacker created a new administrator account. What is the name of the new account that was created?

Task 3: Execution

Execution

Volt Typhoon is known to exploit Windows Management Instrumentation Command-line (WMIC) for a range of execution techniques. They leverage WMIC for tasks such as gathering information and dumping valuable databases, allowing them to infiltrate and exploit target networks. By using "living off the land" binaries (LOLBins), they blend in with legitimate system activity, making detection more challenging.

Answer the questions below

  1. In an information gathering attempt, what command does the attacker run to find information about local drives on server01 & server02?

  2. The attacker uses ntdsutil to create a copy of the AD database. After moving the file to a web server, the attacker compresses the database. What password does the attacker set on the archive?

Task 4: Persistence

Persistence

Our target APT frequently employs web shells as a persistence mechanism to maintain a foothold. They disguise these web shells as legitimate files, enabling remote control over the server and allowing them to execute commands undetected.

Answer the questions below

  1. To establish persistence on the compromised server, the attacker created a web shell using base64 encoded text. In which directory was the web shell placed?

Task 5: Defense Evasion

Defense Evasion

Volt Typhoon utilizes advanced defense evasion techniques to significantly reduce the risk of detection. These methods encompass regular file purging, eliminating logs, and conducting thorough reconnaissance of their operational environment.

Answer the questions below

  1. In an attempt to begin covering their tracks, the attackers remove evidence of the compromise. They first start by wiping RDP records. What PowerShell cmdlet does the attacker use to remove the “Most Recently Used” record?

  2. The APT continues to cover their tracks by renaming and changing the extension of the previously created archive. What is the file name (with extension) created by the attackers?

  3. Under what regedit path does the attacker check for evidence of a virtualized environment?

Task 6: Credential Access

Credential Access

Volt Typhoon often combs through target networks to uncover and extract credentials from a range of programs. Additionally, they are known to access hashed credentials directly from system memory.

Answer the questions below

  1. Using reg query, Volt Typhoon hunts for opportunities to find useful credentials. What three pieces of software do they investigate?
    Answer Format: Alphabetical order separated by a comma and space.

  2. What is the full decoded command the attacker uses to download and run mimikatz?

Task 7: Discovery & Lateral Movement

Discovery

Volt Typhoon uses enumeration techniques to gather additional information about network architecture, logging mechanisms, successful logins, and software configurations, enhancing their understanding of the target environment for strategic purposes.

Lateral Movement

The APT has been observed moving previously created web shells to different servers as part of their lateral movement strategy. This technique facilitates their ability to traverse through networks and maintain access across multiple systems.

Answer the questions below

  1. The attacker uses wevtutil, a log retrieval tool, to enumerate Windows logs. What event IDs does the attacker search for?
    Answer Format: Increasing order separated by a space.

  2. Moving laterally to server-02, the attacker copies over the original web shell. What is the name of the new web shell that was created?

Task 8: Collection

Collection

During the collection phase, Volt Typhoon extracts various types of data, such as local web browser information and valuable assets discovered within the target environment.

Answer the questions below

  1. The attacker is able to locate some valuable financial information during the collection phase. What three files does Volt Typhoon make copies of using PowerShell?
    Answer Format: Increasing order separated by a space.

Task 9: C2 & Cleanup

C2

Volt Typhoon utilizes publicly available tools as well as compromised devices to establish discreet command and control (C2) channels.

Cleanup

To cover their tracks, the APT has been observed deleting event logs and selectively removing other traces and artifacts of their malicious activities.

Answer the questions below

  1. The attacker uses netsh to create a proxy for C2 communications. What connect address and port does the attacker use when setting up the proxy?
    Answer Format: IP Port

  2. To conceal their activities, what are the four types of event logs the attacker clears on the compromised system?

Room Icon

Volt Typhoon

Investigate a suspected intrusion by the notorious APT group Volt Typhoon.

medium

90 min

7,546

User profile photo.
User profile photo.

To access material, start machines and answer questions login.

Score updated
Score updated

Set up your virtual environment

To successfully complete this room, you'll need to set up your virtual environment. This involves starting both your AttackBox (if you're not using your VPN) and Lab Machines, ensuring you're equipped with the necessary tools and access to tackle the challenges ahead.
Attacker machine
Status:Off
Lab machine
Status:Off

Volt Typhoon

Scenario: The has detected suspicious activity indicative of an advanced persistent threat () group known as Volt Typhoon, notorious for targeting high-value organizations. Assume the role of a security analyst and investigate the intrusion by retracing the attacker's steps.

You have been provided with various log types from a two-week time frame during which the suspected attack occurred. Your ability to research the suspected APT and understand how they maneuver through targeted networks will prove to be just as important as your skills. 

Connect to OpenVPN or use the AttackBox to access Splunk. Please give the machine about 4 minutes to boot.

Splunk Credentials
Username: volthunter


Password: voltyp1010
Splunk URL: http://MACHINE_IP:8000

Answer the questions below
I understand my duties and have started the attached lab machine.

Initial Access

Volt Typhoon often gains initial access to target networks by exploiting vulnerabilities in enterprise software. In recent incidents, Volt Typhoon has been observed leveraging vulnerabilities in Zoho ManageEngine ADSelfService Plus, a popular self-service password management solution used by organizations.

Answer the questions below

Comb through the ADSelfService Plus logs to begin retracing the attacker’s steps. At what time (ISO 8601 format) was Dean's password changed and their account taken over by the attacker?

Shortly after Dean's account was compromised, the attacker created a new administrator account. What is the name of the new account that was created?

Execution

Volt Typhoon is known to exploit Windows Management Instrumentation Command-line (WMIC) for a range of execution techniques. They leverage WMIC for tasks such as gathering information and dumping valuable databases, allowing them to infiltrate and exploit target networks. By using "living off the land" binaries (LOLBins), they blend in with legitimate system activity, making detection more challenging.

Answer the questions below

In an information gathering attempt, what command does the attacker run to find information about local drives on server01 & server02?

The attacker uses ntdsutil to create a copy of the AD database. After moving the file to a web server, the attacker compresses the database. What password does the attacker set on the archive?

Our target frequently employs web shells as a persistence mechanism to maintain a foothold. They disguise these web shells as legitimate files, enabling remote control over the server and allowing them to execute commands undetected.

Answer the questions below

To establish persistence on the compromised server, the attacker created a web shell using base64 encoded text. In which directory was the web shell placed?

Defense Evasion

Volt Typhoon utilizes advanced defense evasion techniques to significantly reduce the risk of detection. These methods encompass regular file purging, eliminating logs, and conducting thorough reconnaissance of their operational environment.

Answer the questions below

In an attempt to begin covering their tracks, the attackers remove evidence of the compromise. They first start by wiping RDP records. What PowerShell cmdlet does the attacker use to remove the “Most Recently Used” record?

The APT continues to cover their tracks by renaming and changing the extension of the previously created archive. What is the file name (with extension) created by the attackers?

Under what regedit path does the attacker check for evidence of a virtualized environment?

Credential Access

Volt Typhoon often combs through target networks to uncover and extract credentials from a range of programs. Additionally, they are known to access hashed credentials directly from system memory.

Answer the questions below

Using reg query, Volt Typhoon hunts for opportunities to find useful credentials. What three pieces of software do they investigate?
Answer Format: Alphabetical order separated by a comma and space.

What is the full decoded command the attacker uses to download and run mimikatz?

Discovery

Volt Typhoon uses enumeration techniques to gather additional information about network architecture, logging mechanisms, successful logins, and software configurations, enhancing their understanding of the target environment for strategic purposes.

Lateral Movement

The has been observed moving previously created web shells to different servers as part of their lateral movement strategy. This technique facilitates their ability to traverse through networks and maintain access across multiple systems.

Answer the questions below

The attacker uses wevtutil, a log retrieval tool, to enumerate Windows logs. What event IDs does the attacker search for?
Answer Format: Increasing order separated by a space.

Moving laterally to server-02, the attacker copies over the original web shell. What is the name of the new web shell that was created?

Collection

During the collection phase, Volt Typhoon extracts various types of data, such as local web browser information and valuable assets discovered within the target environment.

Answer the questions below

The attacker is able to locate some valuable financial information during the collection phase. What three files does Volt Typhoon make copies of using PowerShell?
Answer Format: Increasing order separated by a space.

Volt Typhoon utilizes publicly available tools as well as compromised devices to establish discreet command and control (C2) channels.

Cleanup

To cover their tracks, the has been observed deleting event logs and selectively removing other traces and artifacts of their malicious activities.

Answer the questions below

The attacker uses netsh to create a proxy for C2 communications. What connect address and port does the attacker use when setting up the proxy?
Answer Format: IP Port

To conceal their activities, what are the four types of event logs the attacker clears on the compromised system?