Volt Typhoon: State-Actor Intrusion & Domain Compromise
| Report ID | INC2024-0324-VT | Classification | Simulated / Training Environment |
| Analyst | F. Nanos | Platform | TryHackMe (SIEM investigation) |
| Severity | Critical | Status | Closed (Investigation Complete) |
| Attributed Actor | Volt Typhoon (state-sponsored, living-off-the-land tradecraft) | ||
1. Executive Summary
Over a six-day window, an Active Directory environment was subjected to a deliberate, multi-stage intrusion consistent with the tradecraft of Volt Typhoon, a state-sponsored threat group known for targeting critical infrastructure and for heavy reliance on living-off-the-land techniques. Initial access was obtained by abusing an unauthenticated password-reset weakness in an internet-facing identity self-service portal. The attacker then created a hidden administrative backdoor, extracted the entire domain credential database, harvested credentials from memory, staged sensitive financial records, deployed web shells for durable access, and finally cleared event logs and network configuration to frustrate investigation.
Although the attacker cleared the Windows event logs at the end of the operation, telemetry forwarded to the SIEM beforehand allowed a complete, corroborated timeline to be reconstructed. The single most consequential action was the extraction of the domain credential database, which must be treated as a full domain compromise requiring a complete credential reset.
2. Scope & Methodology
The investigation was conducted in the SIEM against forwarded telemetry from the identity self-service application, Windows Management Instrumentation activity, and PowerShell pipeline logging. The core analytical challenge was reconstructing the timeline after the attacker cleared all local Windows event logs in the final phase; because critical telemetry had already been forwarded, the SIEM retained the record that the endpoint no longer held.
A defining characteristic of this intrusion was the near-exclusive use of legitimate built-in Windows tooling (the domain database utility, WMI, netsh, and the event-log utility), which blends with normal administration and defeats signature-based detection. Reconstruction therefore depended on behavioral sequencing rather than malware signatures.
3. Attack Chain
3.1 Initial Access & Backdoor
An unauthenticated password reset in an internet-facing identity self-service portal was abused to seize an existing administrative account. Approximately two minutes later, a second attacker-controlled administrative account was created, a deliberate redundancy ensuring continued access even if the first compromise were remediated.
3.2 Credential Access
Following drive enumeration of two file servers via WMI, the attacker extracted the entire Active Directory credential database using a legitimate built-in domain utility, then copied it into a web-server directory. Separately, a credential-dumping tool was pulled from an external host and run against process memory, and the registry was searched for stored credentials belonging to remote-access software. These represent two independent credential-theft vectors: the on-disk domain database and live memory.
3.3 Collection & Masquerading
The stolen credential database was compressed into a password-protected, split archive and then renamed to an image-file extension, disguising it as a harmless picture to evade content inspection and blend with web traffic. Three years of financial records were staged in a temporary directory for collection.
3.4 Persistence via Web Shells
An ASP.NET web shell was created on one server by renaming an existing file to a web-executable extension, then copied to a second server under an audit-themed name. Web shells provide a browser-accessible command channel that survives account remediation.
3.5 Anti-Forensic Cleanup
In the final phase, all Windows event logs (Application, Security, Setup, System) were cleared, and a netsh port-forwarding rule was created to relay traffic to an external address, then deleted to remove the configuration evidence. The prior forwarding of telemetry to the SIEM is precisely what preserved the investigative record through this cleanup.
4. Indicators of Compromise
| Type | Indicator | Context |
|---|---|---|
| Backdoor account | [redacted, attacker-created admin] | Persistence / redundancy |
| C2 domain | [redacted, actor-themed domain] | Tool download source |
| C2 relay | [redacted, external IP:port] | netsh port-forward target |
| Domain database dump | [redacted, temp path] | Full credential extraction |
| Disguised archive | [redacted, .7z renamed to image ext] | Staged for exfiltration |
| Web shells | [redacted, .aspx / .jspx] | Durable access, two hosts |
5. MITRE ATT&CK Mapping
| Technique ID | Technique | Tactic |
|---|---|---|
| T1190 | Exploit Public-Facing Application | Initial Access |
| T1136 / T1078.003 | Create Account / Valid Accounts | Persistence |
| T1003.003 | OS Credential Dumping: NTDS | Credential Access |
| T1003.001 | OS Credential Dumping: LSASS Memory | Credential Access |
| T1552.007 | Credentials from Password Stores | Credential Access |
| T1560 / T1036.005 | Archive Collected Data / Masquerading | Collection / Defense Evasion |
| T1505.003 | Web Shell | Persistence |
| T1070.001 | Clear Windows Event Logs | Defense Evasion |
| T1090.001 | Internal Proxy (netsh port-forward) | Command and Control |
6. Root Cause & Recommendations
The intrusion was enabled by three compounding weaknesses: an unauthenticated password reset on an internet-facing identity portal (primary root cause), absent multi-factor authentication on privileged accounts, and no alerting on high-risk built-in tooling.
- Patch or isolate the identity self-service portal and remove direct internet exposure where possible.
- Enforce multi-factor authentication on all privileged and administrative accounts.
- Alert on domain-database utility execution and on any access to the credential database outside sanctioned backup windows.
- Alert on event-log clearing and on netsh port-forward rule creation, both high-fidelity intrusion indicators.
- Forward all critical logs to the SIEM in near real time so local log clearing cannot erase the investigative record, the control that made this reconstruction possible.
- On confirmed domain-database extraction, perform a domain-wide credential reset including a double reset of the krbtgt account.
7. Investigator's Notes
The instructive element of this investigation was the living-off-the-land tradecraft. With no custom malware to key on for most stages, detection depended on recognizing that legitimate administrative tools were being used in illegitimate sequences: a domain-database utility run outside backup windows, WMI used for multi-host enumeration, and the event-log utility used to wipe history. The standing lesson is that resilient SIEM forwarding plus behavioral detection on built-in tooling, rather than signature matching, is what defeats an actor who deliberately avoids bringing their own malware.