Chinese hackers Volt Typhoon are back, and rebuilding their botnet to target new victims

Insecure network with several red platforms connected through glowing data lines and a black hat hacker symbol

(Image credit: Shutterstock)

Volt Typhoon is rapidly rebuilding its botnet of legacy routers
Traffic is being obscured through webshells and MIPS-based malware
Critical infrastructure needs to upgrade away from EOL devices

US allies and authorities recently dismantled parts of a network of legacy routers in small offices and home offices (SOHO) infected with the KV Botnet malware, used by the notorious Volt Typhoon group to target US critical infrastructure.

However, a huge new botnet targeting the same vulnerable legacy edge devices within critical infrastructure is rapidly growing, and Security Scorecard’s STRIKE Team thinks it is Volt Typhoon emerging from the ashes.

‘End-of-life’ (EOL) devices, those for which manufacturer support has ended, are again the main targets for this growing network.

SOHO and EOL devices

This time, Volt Typhoon has adapted to more effectively obscure its traffic using a number of tactics. By using SOHO and EOL devices, Volt Typhoon can maintain persistence within legacy routers without fear of security updates that could potentially boot them from their infrastructure. The group has also been spotted using MIPS-based malware to hide its connections and communications through port forwarding via 8433.

Webshells are also being implanted into routers to maintain remote control, which also disguise malicious traffic inside the router's standard network operations. Many of these devices have been detected on the Pacific island of New Caledonia, acting as a transfer point for traffic coming from Volt Typhoon in the Asia-Pacific region heading into the US, and vice versa.

The prime targets of Volt Typhoon’s activities are Cisco RV320/325 and Netgear ProSafe routers. Software maintenance releases and bug fixes for the Cisco RV320/325 ended in 2021, with STRIKE Team highlighting that Volt Typhoon compromised 30% of visible Cisco RV320/325 routers in just 37 days, with government and critical infrastructure being prime targets.

STRIKE Team recommends that government departments should address weaknesses such as the use of legacy devices within critical infrastructure to reduce the number of potential vulnerabilities and access points for cyber criminal organizations and state-sponsored groups.

These are the best business VPNs
US government agency warns workers of possible Chinese cellphone hacks
Take a look at the best endpoint protection software

Benedict has been writing about security issues for over 7 years, first focusing on geopolitics and international relations while at the University of Buckingham. During this time he studied BA Politics with Journalism, for which he received a second-class honours (upper division), then continuing his studies at a postgraduate level, achieving a distinction in MA Security, Intelligence and Diplomacy. Upon joining TechRadar Pro as a Staff Writer, Benedict transitioned his focus towards cybersecurity, exploring state-sponsored threat actors, malware, social engineering, and national security. Benedict is also an expert on B2B security products, including firewalls, antivirus, endpoint security, and password management.