500-710 learner - Cisco Video Infrastructure Implementation Updated: 2023

The Transformational Tech series highlights Cisco’s grant recipients that use technology to help transform the lives of individuals and communities.

An estimated 37% of the world’s population – or 2.9 billion people – have still never used the internet and are missing out on the wealth of learning opportunities available online.

In addition, when reflecting on the past three years, the effects from pandemic school closures remain and have had a lasting impact on teacher wellbeing, and student learning proficiency levels globally. This situation was particularly true in communities without reliable access to the internet or technologies to aid teachers and families with remote instruction. More is needed to help this population of learners accelerate learning to meet minimum learning proficiency levels country by country. And more needs to be done to inclusively connect these communities and their students to trained teachers and quality classroom resources.

World Possible is a Cisco nonprofit partner who bridges these gaps and connects offline learners to the world’s knowledge with an educational server called RACHEL (Remote Area Community Hotspot for Education and Learning). RACHEL is an innovative learning tool for teachers to engage their students and bridge the digital divide and help scale teacher productivity while working with diverse classrooms.

In appreciation of educators everywhere, we want to shine a light on World Possible technology being used by teachers and students in Oceania, Asia and Latin America. In these examples, RACHEL is used to build teacher capacity, increase student engagement, and Strengthen overall classroom performance while helping students living in remote and disconnected communities build digital skills.

Oceania – Kiribati:  

Kiribati is an island country composed of over 30 atolls with over 17,500 students attending 110 schools. These students and their teachers are spread over 3.5 million square kilometers in the central Pacific Ocean. With such a dispersed and distributed population, education officials address the challenge of providing access to trained teachers with current curriculum in programs like the Kiribati Education Improvement Program.

Kiribati Education officials use RACHEL server devices to store digital media within key training schools. These servers have the flexibility to be solar powered with battery backup support to reach even the most remote areas of this island country. With the high cost of internet, which is primarily only available through mobile phone data plans, access to these resources at scale isn’t sustainable for these communities. But a RACHEL content device changes this dynamic, making professional training and receiving updated content easier.

Asia – Cambodia:

The International Telecommunication Union (ITU) is the United Nations specialized agency for information and communication technologies and is committed to connecting all the world’s people. Through their work, ITU Data Hub reports indicate that 60% of individuals in Cambodia  are using the internet compared with the world average of 66%. This gap in access to the internet within Cambodia increases in rural and remote populations. World Possible serves as a bridge for this digital divide for teachers and students in rural Cambodia.

At Doris Dillon School, the World Possible RACHEL server is used directly by students in classrooms to learn English, Strengthen numeracy skills and build digital skills using computers. The RACHEL device also acts as a community digital library, used by families for gardening, health education and computer classes.

Latin America – Guatemala

Within Latin America, access to the internet and technology for use in schools can be challenging. In Guatemala, the same ITU Data Hub reports indicate that 51% of individuals in the country are using the internet compared with the world average of 66%. With a beautiful and rugged landscape, Guatemala has high mountain ranges dotted with volcanos, jungle regions and large urban cities such as Guatemala City or Quetzaltenango in the northern highlands. Within this diverse geography is a school using RACHEL located in Sacsiguán Monte Mercedes, a small village from Sololá, in the western highlands of Guatemala. In this remote and rural area, Elvia Patricia Julajuj Cuxulic, who is an accountant by profession, teaches in the Monte Mercedes Secondary School leads seven classes of students every week in the afternoons serving 87 students from grades 7 to 9.

Earlier this year her school received a RACHEL server that is now being used by students who previously had little access to the internet. As a teacher, Elvia has been actively using the device with her students and reports to the Ministry of Education show over 130,000 logged events, and 66,900 pages visited. As one of four teachers in Monte Mercedes Secondary School, she hopes that her students and her community will all have the chance of having a better life through education.

More to come

Cisco inclusively invests using a portfolio approach in nonprofits to further STEM Education student outcomes, inspire youth to regenerate our climate and develop trained teacher capacity globally. Through investment partners like World Possible we aim to strengthen human capital, inclusively connect people to resources and services with quality platforms informed by education proven practice.

This fall, World Possible will release an upgraded RACHEL server with increased capacity for concurrent device connections, improved device storage, and will leverage a new processor. Through a new server, coupled with the cloud update service called DataPost, education officials can use Android devices to update RACHEL servers in remote locations around the world.  To learn more about RACHEL visit WorldPossible.org.

View original content here

Cisco Systems Inc. will hold its annual Cisco Live user event next week in Las Vegas as the networking giant is coming off an impressive quarter in which Chief Executive Chuck Robbins (pictured) set a more than positive outlook for the company.

Given that the secular trends of cloud, mobility and hybrid work act as long-term tailwinds, I’m expecting the company to load up this year’s Cisco Live with announcements that sets itself up for many years. Here are some of the key themes I’m expecting from Cisco Live 2023:

Security evolution

Of all the product areas, I’m most interested to see what Cisco announces in security. In my security platform post, I mentioned that security provides the biggest needle-moving opportunity, since the company currently has single-digit share in a massive market. For Cisco, security innovation is less about new products and more about integration across its broad range of existing products.

The company announced XDR at the RSA Conference recently, and now it needs to build on that to make using Cisco security operationally simpler. Also, the prevailing trend is now toward a security platform, so any coupling that Cisco can do to tie security to its massive network installed base will only help it gain on the likes of Palo Alto Networks Inc. and Fortinet Inc.

The new security leadership at Cisco, which includes Jeetu Patel and Tom Gillis, seems well aware of what’s at stake. I’m hopeful that when Cisco Live is over, security will dominate the product news.

Artificial intelligence

One can’t go to an event this year without hearing about AI. Although I’m not expecting Cisco to hit the audience over the head with AI, I do expect it will be a major theme of how it will use it to evolve its products.

In reality, Cisco has been using machine learning and AI for years to modernize its products. Its encrypted traffic analytics uses AI, as does its XDR offering. Cisco Webex uses AI for many core features, including noise block, transcription and translation. Also, its network automation and intent-based capabilities require AI to translate network telemetry into actionable tasks.

I’m sure most of the products announced at Cisco Live will include AI in some manner. The only question is how overt Cisco will be about it, given the current market hype.

The other aspect of AI that could be introduced is generative AI and how Cisco will use it to Strengthen its products. The tie-in to Webex is obvious, as a worker can use it to find information or create content. With networking and security, Cisco’s operational dashboards could feature a ChatGPT-like interface to identify and solve problems. Given the R&D time required with infrastructure, I’m not expecting a big dose of generative AI.

Continued simplification of networking

If there were a market tracker for “single panes of glass,” Cisco would be the runaway leader, as it seems to have a dashboard for everything. At Cisco Live 2022, the company took its first step in addressing this by integrating Catalyst and Meraki, where administrators could see Catalyst devices in the Meraki dashboard.

We are a year removed from that, and we should see product areas addressed, including Cisco Spaces (formerly DNA), Viptela SD-WAN and Wi-Fi. Like with security, product breadth isn’t Cisco’s problem because it has a broader portfolio than any other network vendor, but it has made it operationally very difficult for customers to use multiple Cisco products. The pace of change in information technology is faster than ever, and improved cross-platform operations will help Cisco network engineers align operations with business demands.

More ThousandEyes and AppDynamics

ThousandEyes and “AppD” enable Cisco customers to “see” where no network engineer has seen before. ThousandEyes provides visibility across the internet, which wasn’t necessary a decade ago, but the cloud and software-defined wide-area network changed that. IT pros are responsible for user and customer experience, and the internet is widely used for business traffic, making it critical for network professionals to have granular visibility.

AppD is an application performance product, and one might wonder why a network vendor would care about apps. An understanding of application behavior can help network and security pros prioritize tasks. For example, its business risk observability offering announced at Cisco Live EMEA earlier this year can map vulnerabilities and threat intelligence to business context, helping security engineers understand where to prioritize activities. AppD information should be the lens through which almost all Cisco information is viewed, as it can translate between telemetry and business performance.

Environmental, social and governance update

Cisco has had a strong focus on ESG long before it was in vogue. Its mission of making the world a better place dates back decades to when then-CEO John Chambers used to talk about how the internet could be used to democratize education, creating opportunities where none existed before. Under Robbins, Cisco has stepped up its ESG game with aggressive goals of the number of people it could positively affect.

There hasn’t been a Cisco Live under Robbins where ESG hasn’t been a key subject area, and I have no reason to assume that will change. Of all the areas that fall under ESG, sustainability is the one many businesses struggle with today. At IBM Think, CEO Arvind Krishna highlighted that its data showed that there was a massive gap between their customer’s goals and their ability to execute on those goals.

Cisco has been designing its product with sustainability in mind, including power-saving and efficiency features. The exhibit hall at Cisco Live EMEA featured a sustainability zone, and I would expect the same in Las Vegas to help customers understand what’s possible today.

I’m sure there will be some new products announced at Cisco Live, but the theme of this year’s event should be cross-product innovation. At $60 billion in revenue, Cisco has a massive portfolio of products that address everything from data centers to telco networks to cloud to campus networks. Cisco leadership has continually touted the importance of making the products easier to use, which is not a trivial thing to do, but it is what I’m expecting at Cisco Live 2023 in Las Vegas.

Zeus Kerravala is a principal analyst at ZK Research, a division of Kerravala Consulting. He wrote this article for SiliconANGLE.

Photo: Cisco/livestream

Copyright © 2023 IDG Communications, Inc.

Launch to mark Cisco joining Greater Manchester Digital Security Hub

Cisco today announced that it is joining the Greater Manchester Digital Security Hub (DiSH) to support the centre’s ambitions to be at the forefront of cybersecurity and innovation, support economic growth and resilience, and to help make the region a trusted and secure place to live, study, and work.

As part of this collaboration, through Cisco’s Country Digital Acceleration (CDA) programme, Cisco is launching a series of targeted initiatives to tackle the widening cybersecurity skills gap. Dedicated programmes will focus on three key areas: the most vulnerable organisations, the widest gap in the industry, and the future generation who will live and work in the region as it realises its digital ambitions.

The Most Vulnerable Organisations

According to Cisco research, half of small businesses (50%) are underprepared when it comes to cybersecurity, leaving them vulnerable to breaches. A core ambition of DiSH is to future-proof Greater Manchester and bring together industry, start-ups, and small and medium-sized enterprises to develop solutions with real-world application that will enhance public and private cyber resilience and digital security.

As part of its role with DiSH, the centre will become a Cisco Networking Academy specifically to support small businesses with their cybersecurity skills. The programme will include a range of learning opportunities starting with a free, self-paced, mobile-friendly ‘Introduction to Cybersecurity’ course. The aim of the course is to equip learners with a basic awareness of cyber vulnerabilities and an understanding of the core principles of cyber resilience. Once users have completed the course, they will have access to additional learning pathways facilitated by Cisco’s partnership with UCEN Manchester.

Jon Lomas, Cybersecurity Partnership Development Manager, DiSH commented: “We greatly value the opportunity to partner with Cisco, a global leader in cybersecurity, to help deliver the critical skills needed to protect businesses of all sizes from potential attacks in an increasingly complicated threat landscape. Becoming a Cisco Networking Academy will help us to deliver free and easily accessible training for our local business population to help them address the security risks they face.”

The Widest Gap in the Industry

As cybersecurity threats continue to rise, the need for a skilled, diverse cyber workforce is more important than ever. Yet, the global cybersecurity workforce was reportedly short of 3.5 million workers in 2021 and constituted less than 25% women.

Cisco’s latest programme, launched today in partnership with the Open University, ‘Cisco Cyber Camps’, will provide free, remote, self-paced training for students in the UK, aged 13-19, who identify as female or non-binary. The courses will allow young women to learn industry-ready cybersecurity skills, while also engaging in forums hosted by Cisco Networking Academy expert women instructors, attending online webinars, and embarking on soft skills training. Upon successful completion of the course, students will receive a certification that will then allow them to go on to complete advanced cybersecurity qualifications and courses.

There will be four enrolment dates each year in January, April, July, and October. To find out more, or sign up for the next cohort, visit here.

Andrew Smith, Senior Lecturer in Networking, Open University Cisco Academy Support Centre, said: “The rapid expansion of the digital economy has created many more cybersecurity challenges that need to be tackled by organisations daily. We urgently need to close the security skills gap, as job vacancies continue to outweigh available expert talent. We look forward to our continued collaboration with Cisco to support the training of talented women to fulfil these critical roles and boost innovation through gender diversity.”

The Future Generation who Will Live and Work in the Digital City-region

Cisco’s partnerships with the Open University and UCEN Manchester have been designed to equip young people with the cybersecurity skills needed to help Greater Manchester succeed in its ambitions to become an internationally recognised digital city-region, attracting industry investment, connecting communities, and driving the local economy. The partnerships focus on providing:

• Free, self-paced, and online instructor training programmes, led by a consortium of Cisco Networking Academy partners including the Open University and UCEN Manchester, which work around teachers’ busy schedules, as an exciting opportunity to upskill and support their continuing professional development.
• Industry-accredited materials and resources designed for those delivering cybersecurity training to their students, closely mapped to the T-Level curriculum. Aligning the courses with classroom teaching offers students in Greater Manchester vendor-led training that will enhance their future job applications.
• Teacher training and skills-to-jobs learning for pupils in the Dean Trust schools and academies across the Greater Manchester region, as well as further schools supported by UCEN Manchester.

David Meads, Chief Executive, Cisco UK & Ireland, commented: “As Greater Manchester realises its digital ambition, it’s crucial that we equip everyone who lives and works in the region with the awareness, tools, and skills to help Strengthen their security resilience. We’re delighted to be working with DiSH, and its founding partners to do just that.”

This announcement builds on Cisco’s role in delivering the Greater Manchester One Network initiative, designed to provide continued trusted access to everything and everyone in the public sector. As part of this initiative, Cisco will deploy a secure, self-monitoring, region-wide digital infrastructure to help underpin public services in the region.

Want to learn more about the digital transformation of Greater Manchester and the North of the UK? Join the telecoms industry in discussion at next year’s Connected North conference

Also in the news:
Tusass: Connecting Greenland’s remote communities
Watchdog hits Eir with €2.45m fine for overcharging customers
SENSE: Nokia and Citymesh launch national drone network in Belgium

There is a continued push in the power generation sector to make the industry more efficient through the use of artificial intelligence (AI), machine learning, and data science. Several companies are working to provide products and services for utilities and other power producers, focused on generation, transmission and distribution, and the way utilities interact with their customers.

Buzz Solutions, a Palo Alto, California-based group, is known for products that make the power grid smarter and more resilient, with an emphasis on technology and environmental sustainability. The company provides an AI-powered software and predictive analytics platform for detecting faults and anomalies on power line assets and components for power utilities. Buzz works with utilities to prevent downed power lines, outages, and as part of efforts to prevent and mitigate wildfires that could be caused by a utility’s equipment.

Buzz has partnered with the New York Power Authority (NYPA) on inspections of NYPA’s high-voltage power infrastructure, as well as with Newfoundland Power, where Buzz has inspected the group’s low-voltage infrastructure. Buzz also works with customers to deliver real-time, condition-based equipment monitoring and surveillance, both on the ground and in the air. These inspections could be at a substation, or along a transmission line, or at a power generation facility such as a hydropower dam.

Want to learn more about the use of data, artificial intelligence, and machine learning in the power generation industry? Register today for POWER’s Connected Plant Conference, June 25-28 in New Orleans, Louisiana, and for POWER’s Experience POWER Week, set for Aug. 14-17 in Savannah, Georgia.

Vikhyat Chaudhry is the co-founder, chief technology officer, and chief operations officer at Buzz Solutions. He previously led machine learning and AI teams at Cisco Systems. His works focuses on energy engineering and data science, machine learning, and AI technologies for the energy sector, specifically in smart grid technologies, demand response, clean energy technologies, and energy efficiency.

Kaitlyn Albertoli is CEO and co-founder of Buzz Solutions. She was previously a wealth management analyst at JP Morgan Chase, and also ran a non-profit organization focused on sustainable food.

Buzz Solutions was founded as part of the Stanford Launchpad project in 2017. Both Chaudry and Albertoli are Stanford graduates. Albertoli has said that the company was created to address the need to acquire more visual data “to ensure and enable thorough and frequent inspections” of power generation and transmission infrastructure, and to help utilities develop better inspection strategies and programs.

Chaudhry and Albertoli recently provided POWER with their thoughts about the need for utilities to use AI to make their operations more efficient, particularly when it comes to maintenance and upgrades of their power delivery systems.

POWER: There’s wide consensus that the U.S. power grid is badly in need of upgrades in order to lessen power loss, mitigate outages, and integrate more renewable energy. How can these upgrades occur in a timely and cost-effective manner?

Albertoli: There are a few ways we can think about modernizing the U.S. power grid, but before we talk about the work, we have to talk about the data that supports the work. The challenge that utilities currently face is a huge backlog in maintenance that leads to anomalies which cause power outages and more.

Utilities have an abundance of data, but the bulk of the analysis is still done manually by lineman and field technicians. At scale, this just doesn’t work. Not only does it prolong the analysis time, but these linemen and field technicians should be focusing their efforts toward grid maintenance and upgrades. With a clearer picture of all of our utility assets, we can Strengthen site inspections, predict where breakdowns might occur and enable utilities to act more quickly and efficiently.

When we are able to shift the industry mindset from a reactive one, where we’re plugging holes as we go, to a proactive one that can plan maintenance and modernize without significant disruption, then we can talk about significant upgrades.

POWER: How important is the use of drones in inspecting transmission infrastructure, and how can AI help interpret the data gathered during the inspection process?

Chaudhry: Drone inspection is safer and far more cost effective than other methods of infrastructure inspection—like helicopters and fixed wing aircrafts. Their size alone allows them to maneuver in a way that allows us to capture more granular information than we were able to before. But alone, drones are not a game changer. It’s the way that drone data capturing and AI are working together that is making a difference in the industry.

What’s most transformative is the sheer speed and accuracy at which AI can analyze what the drones capture. This allows the utilities to inspect hundreds of miles of power lines and analyze for anomalies before they become detrimental or cause serious damage to the surrounding area.

The benefit of AI is the ability to learn from technicians—making the process truly collaborative. Through a process called Human-in-the-loop (HITL), utility technicians can flag unique situations that the AI might have missed or were incorrect and manually input the data. With every manual intervention the AI gets “smarter” and its pattern recognition in unusual situations gets better.

POWER: Are there other new, innovative methods to inspect infrastructure that should be explored?

Chaudhry:  The way the utility sector grows from here is not necessarily about finding new ways to inspect the infrastructure—though I’m sure those will come. It’s about uniting the data we already have to optimize how we repair and modernize our national infrastructure.

One transition we are seeing the utility companies make is adoption of an Advanced Distribution Management System or ADMS. An ADMS is an integrated system that brings together data from across the organization—including what the drones are seeing and the AI analysis created—to optimize energy distribution. The ADMS can do things like anticipate outages and manage intermittency with load forecasting. This is the future technology we should be focused on.

POWER: There are thousands of miles of power lines, along with other transmission and distribution equipment, in need of maintenance and upgrades. What entity—federal, state, and/or local government, or individual utilities or grid operators—should be responsible for this maintenance and upgrades? In other words, who should pay for it?

Albertoli: There are several factors to consider when looking at the required upgrades on the grid and who should pay for it. First, there is a critical time sensitivity for grid maintenance, upgrades and modernization. The U.S. is facing extreme pressures to electrify and to transition to renewable energy resources, yet the grid in its current state is not equipped to sustain such load and imbalance.

With these changes happening at such accelerated rates, it puts the utility under a tremendous time and resource crunch, particularly when you consider that many utilities have thousands, if not tens of thousands of miles of lines.

In order for the utility to effectively maintain and upgrade their infrastructure, it will likely require external funding and even labor resources from federal and state entities. Additionally, successful grid modernization will demand a clear action plan and coordinated efforts from grid operators, utilities, regulators, and government agencies.

—Darrell Proctor is a senior associate editor for POWER (@POWERmagazine).

Microsoft has uncovered stealthy and targeted malicious activity focused on post-compromise credential access and network system discovery aimed at critical infrastructure organizations in the United States. The attack is carried out by Volt Typhoon, a state-sponsored actor based in China that typically focuses on espionage and information gathering. Microsoft assesses with moderate confidence that this Volt Typhoon campaign is pursuing development of capabilities that could disrupt critical communications infrastructure between the United States and Asia region during future crises.

Volt Typhoon has been active since mid-2021 and has targeted critical infrastructure organizations in Guam and elsewhere in the United States. In this campaign, the affected organizations span the communications, manufacturing, utility, transportation, construction, maritime, government, information technology, and education sectors. Observed behavior suggests that the threat actor intends to perform espionage and maintain access without being detected for as long as possible. Microsoft is choosing to highlight this Volt Typhoon activity at this time because of our significant concern around the potential for further impact to our customers. Although our visibility into these threats has given us the ability to deploy detections to our customers, the lack of visibility into other parts of the actor’s activity compelled us to drive broader community awareness and further investigations and protections across the security ecosystem.

To achieve their objective, the threat actor puts strong emphasis on stealth in this campaign, relying almost exclusively on living-off-the-land techniques and hands-on-keyboard activity. They issue commands via the command line to (1) collect data, including credentials from local and network systems, (2) put the data into an archive file to stage it for exfiltration, and then (3) use the stolen valid credentials to maintain persistence. In addition, Volt Typhoon tries to blend into normal network activity by routing traffic through compromised small office and home office (SOHO) network equipment, including routers, firewalls, and VPN hardware. They have also been observed using custom versions of open-source tools to establish a command and control (C2) channel over proxy to further stay under the radar.

In this blog post, we share information on Volt Typhoon, their campaign targeting critical infrastructure providers, and their tactics for achieving and maintaining unauthorized access to target networks. Because this activity relies on valid accounts and living-off-the-land binaries (LOLBins), detecting and mitigating this attack could be challenging. Compromised accounts must be closed or changed. At the end of this blog post, we share more mitigation steps and best practices, as well as provide details on how Microsoft 365 Defender detects malicious and suspicious activity to protect organizations from such stealthy attacks. The National Security Agency (NSA) has also published a Cybersecurity Advisory [PDF] which contains a hunting guide for the tactics, techniques, and procedures (TTPs) discussed in this blog.

As with any observed nation-state actor activity, Microsoft has directly notified targeted or compromised customers, providing them with important information needed to secure their environments. To learn about Microsoft’s approach to threat actor tracking, read Microsoft shifts to a new threat actor naming taxonomy.

Initial access

Volt Typhoon achieves initial access to targeted organizations through internet-facing Fortinet FortiGuard devices. Microsoft continues to investigate Volt Typhoon’s methods for gaining access to these devices.

The threat actor attempts to leverage any privileges afforded by the Fortinet device, extracts credentials to an Active Directory account used by the device, and then attempts to authenticate to other devices on the network with those credentials.

Volt Typhoon proxies all its network traffic to its targets through compromised SOHO network edge devices (including routers). Microsoft has confirmed that many of the devices, which include those manufactured by ASUS, Cisco, D-Link, NETGEAR, and Zyxel, allow the owner to expose HTTP or SSH management interfaces to the internet. Owners of network edge devices should ensure that management interfaces are not exposed to the public internet in order to reduce their attack surface. By proxying through these devices, Volt Typhoon enhances the stealth of their operations and lowers overhead costs for acquiring infrastructure.

Post-compromise activity

Once Volt Typhoon gains access to a target environment, they begin conducting hands-on-keyboard activity via the command line. Some of these commands appear to be exploratory or experimental, as the operators adjust and repeat them multiple times.

Volt Typhoon rarely uses malware in their post-compromise activity. Instead, they rely on living-off-the-land commands to find information on the system, discover additional devices on the network, and exfiltrate data. We describe their activities in the following sections, including the most impactful actions that relate to credential access.

Credential access

If the account that Volt Typhoon compromises from the Fortinet device has privileged access, they use that account to perform the following credential access activities.

Microsoft has observed Volt Typhoon attempting to dump credentials through the Local Security Authority Subsystem Service (LSASS). The LSASS process memory space contains hashes for the current user’s operating system (OS) credentials.

Volt Typhoon also frequently attempts to use the command-line tool Ntdsutil.exe to create installation media from domain controllers, either remotely or locally. These media are intended to be used in the installation of new domain controllers. The files in the installation media contain usernames and password hashes that the threat actors can crack offline, giving them valid domain account credentials that they could use to regain access to a compromised organization if they lose access.

Discovery

Microsoft has observed Volt Typhoon discovering system information, including file system types; drive names, size, and free space; running processes; and open networks. They also attempt to discover other systems on the compromised network using PowerShell, Windows Management Instrumentation Command-line (WMIC), and the ping command. In a small number of cases, the threat actors run system checks to determine if they are operating within a virtualized environment.

Collection

In addition to operating system and domain credentials, Volt Typhoon dumps information from local web browser applications. Microsoft has also observed the threat actors staging collected data in password-protected archives.

Command and control

In most cases, Volt Typhoon accesses compromised systems by signing in with valid credentials, the same way authorized users do. However, in a small number of cases, Microsoft has observed Volt Typhoon operators creating proxies on compromised systems to facilitate access. They accomplish this with the built-in netsh portproxy command.

In rare cases, they also use custom versions of open-source tools Impacket and Fast Reverse Proxy (FRP) to establish a C2 channel over proxy.

Compromised organizations will observe C2 access in the form of successful sign-ins from unusual IP addresses. The same user account used for these sign-ins may be linked to command-line activity conducting further credential access. Microsoft will continue to monitor Volt Typhoon and track changes in their activity and tooling.

Mitigation and protection guidance

Mitigating risk from adversaries like Volt Typhoon that rely on valid accounts and living-off-the-land binaries (LOLBins) is particularly challenging. Detecting activity that uses normal sign-in channels and system binaries requires behavioral monitoring. Remediation requires closing or changing credentials for compromised accounts. Suspected compromised accounts or affected systems should be investigated:

• Identify LSASS dumping and domain controller installation media creation to identify affected accounts.
• Examine the activity of compromised accounts for any malicious actions or exposed data.
• Close or change credentials for all compromised accounts. Depending on the level of collection activity, many accounts may be affected.

Defending against this campaign

• Mitigate the risk of compromised valid accounts by enforcing strong multi-factor authentication (MFA) policies using hardware security keys or Microsoft Authenticator. Passwordless sign-in, password expiration rules, and deactivating unused accounts can also help mitigate risk from this access method.
• Reduce the attack surface. Microsoft customers can turn on the following attack surface reduction rules to block or audit some observed activity associated with this threat:
  • Block credential stealing from the Windows local security authority subsystem (lsass.exe).Block process creations originating from PSExec and WMI commands. Some organizations may experience compatibility issues with this rule on certain server systems but should deploy it to other systems to prevent lateral movement originating from PsExec and WMI.
• Harden the LSASS process by enabling Protective Process Light (PPL) for LSASS on Windows 11 devices. New, enterprise-joined Windows 11 (22H2 update) installs have this feature enabled by default. In addition, enable Windows Defender Credential Guard, which is also turned on by default for organizations using the Enterprise edition of Windows 11.
• Turn on cloud-delivered protection in Microsoft Defender Antivirus to cover rapidly evolving attacker tools, techniques, and behaviors such as those exhibited by Volt Typhoon.
• Run endpoint detection and response (EDR) in block mode so that Microsoft Defender for Endpoint can block malicious artifacts, even when your non-Microsoft antivirus does not detect the threat, or when Microsoft Defender Antivirus is running in passive mode. EDR in block mode works behind the scenes to remediate malicious artifacts that are detected post-compromise.

Detection details and hunting queries

Microsoft Defender Antivirus

Microsoft Defender Antivirus detects attempted post-compromise activity. Note, however, that these alerts can also be triggered by threat activity unrelated to Volt Typhoon. Turn on cloud-delivered protection to cover rapidly evolving attacker tools and techniques. Cloud-based machine learning protections block most new and unknown threats.

• Behavior:Win32/SuspNtdsUtilUsage.A
• Behavior:Win32/SuspPowershellExec.E
• Behavior:Win32/SuspRemoteCmdCommandParent.A
• Behavior:Win32/UNCFilePathOperation
• Behavior:Win32/VSSAmsiCaller.A
• Behavior:Win32/WinrsCommand.A
• Behavior:Win32/WmiSuspProcExec.J!se
• Behavior:Win32/WmicRemote.A
• Behavior:Win32/WmiprvseRemoteProc.B

Microsoft Defender for Endpoint

Microsoft Defender for Endpoint alerts with the following titles can indicate possible presence of Volt Typhoon activity.

• Volt Typhoon threat actor detected

The following alerts may also be associated with Volt Typhoon activity. Note, however, that these alerts can also be triggered by threat activity unrelated to Volt Typhoon.

• A machine was configured to forward traffic to a non-local address
• Ntdsutil collecting Active Directory information
• Password hashes dumped from LSASS memory
• Suspicious use of wmic.exe to execute code
• Impacket toolkit

Hunting queries

Microsoft 365 Defender

Volt Typhoon’s post-compromise activity usually includes distinctive commands. Searching for these can help to determine the scope and impact of an incident.

Find commands creating domain controller installation media

This query can identify domain controller installation media creation commands similar to those used by Volt Typhoon.

DeviceProcessEvents
| where ProcessCommandLine has_all ("ntdsutil", "create full", "pro")

Find commands establishing internal proxies

This query can identify commands that establish internal proxies similar to those used by Volt Typhoon.

DeviceProcessEvents
| where ProcessCommandLine has_all ("portproxy", "netsh", "wmic", "process call create", "v4tov4")

Find detections of custom FRP executables

This query can identify alerts on files that match the SHA-256 hashes of known Volt Typhoon custom FRP binaries.

AlertEvidence
| where SHA256 in 
('baeffeb5fdef2f42a752c65c2d2a52e84fb57efc906d981f89dd518c314e231c', 
'b4f7c5e3f14fb57be8b5f020377b993618b6e3532a4e1eb1eae9976d4130cc74', 
'4b0c4170601d6e922cf23b1caf096bba2fade3dfcf92f0ab895a5f0b9a310349', 
'c0fc29a52ec3202f71f6378d9f7f9a8a3a10eb19acb8765152d758aded98c76d', 
'd6ab36cb58c6c8c3527e788fc9239d8dcc97468b6999cf9ccd8a815c8b4a80af', 
'9dd101caee49c692e5df193b236f8d52a07a2030eed9bd858ed3aaccb406401a', 
'450437d49a7e5530c6fb04df2e56c3ab1553ada3712fab02bd1eeb1f1adbc267', 
'93ce3b6d2a18829c0212542751b309dacbdc8c1d950611efe2319aa715f3a066', 
'7939f67375e6b14dfa45ec70356e91823d12f28bbd84278992b99e0d2c12ace5', 
'389a497f27e1dd7484325e8e02bbdf656d53d5cf2601514e9b8d8974befddf61', 
'c4b185dbca490a7f93bc96eefb9a597684fdf532d5a04aa4d9b4d4b1552c283b', 
'e453e6efc5a002709057d8648dbe9998a49b9a12291dee390bb61c98a58b6e95', 
'6036390a2c81301a23c9452288e39cb34e577483d121711b6ba6230b29a3c9ff', 
'cd69e8a25a07318b153e01bba74a1ae60f8fc28eb3d56078f448461400baa984', 
'17506c2246551d401c43726bdaec800f8d41595d01311cf38a19140ad32da2f4', 
'8fa3e8fdbaa6ab5a9c44720de4514f19182adc0c9c6001c19cf159b79c0ae9c2', 
'd17317e1d5716b09cee904b8463a203dc6900d78ee2053276cc948e4f41c8295', 
'472ccfb865c81704562ea95870f60c08ef00bcd2ca1d7f09352398c05be5d05d', 
'3e9fc13fab3f8d8120bd01604ee50ff65a40121955a4150a6d2c007d34807642')

Microsoft Sentinel

Below are some suggested queries to assist Microsoft Sentinel customers in identifying Volt Typhoon activity in their environment:

Microsoft customers can use the TI Mapping analytics (a series of analytics all prefixed with ‘TI map’) to automatically match the malicious hash indicators (related to the custom Fast Reverse Proxy binaries) mentioned in this blog post. These analytics are part of the Threat Intelligence solution and can be installed from the Microsoft Sentinel Content Hub if not currently deployed. More details on the Content Hub can be found here: https://learn.microsoft.com/azure/sentinel/sentinel-solutions-deploy.

Indicators of compromise (IOCs)

The below list provides IOCs observed during our investigation. We encourage our customers to investigate these indicators in their environments and implement detections and protection to identify past related activity and prevent future attacks against their systems.

Volt Typhoon custom FRP executable (SHA-256):

• baeffeb5fdef2f42a752c65c2d2a52e84fb57efc906d981f89dd518c314e231c
• b4f7c5e3f14fb57be8b5f020377b993618b6e3532a4e1eb1eae9976d4130cc74
• 4b0c4170601d6e922cf23b1caf096bba2fade3dfcf92f0ab895a5f0b9a310349
• c0fc29a52ec3202f71f6378d9f7f9a8a3a10eb19acb8765152d758aded98c76d
• d6ab36cb58c6c8c3527e788fc9239d8dcc97468b6999cf9ccd8a815c8b4a80af
• 9dd101caee49c692e5df193b236f8d52a07a2030eed9bd858ed3aaccb406401a
• 450437d49a7e5530c6fb04df2e56c3ab1553ada3712fab02bd1eeb1f1adbc267
• 93ce3b6d2a18829c0212542751b309dacbdc8c1d950611efe2319aa715f3a066
• 7939f67375e6b14dfa45ec70356e91823d12f28bbd84278992b99e0d2c12ace5
• 389a497f27e1dd7484325e8e02bbdf656d53d5cf2601514e9b8d8974befddf61
• c4b185dbca490a7f93bc96eefb9a597684fdf532d5a04aa4d9b4d4b1552c283b
• e453e6efc5a002709057d8648dbe9998a49b9a12291dee390bb61c98a58b6e95
• 6036390a2c81301a23c9452288e39cb34e577483d121711b6ba6230b29a3c9ff
• cd69e8a25a07318b153e01bba74a1ae60f8fc28eb3d56078f448461400baa984
• 17506c2246551d401c43726bdaec800f8d41595d01311cf38a19140ad32da2f4
• 8fa3e8fdbaa6ab5a9c44720de4514f19182adc0c9c6001c19cf159b79c0ae9c2
• d17317e1d5716b09cee904b8463a203dc6900d78ee2053276cc948e4f41c8295
• 472ccfb865c81704562ea95870f60c08ef00bcd2ca1d7f09352398c05be5d05d
• 3e9fc13fab3f8d8120bd01604ee50ff65a40121955a4150a6d2c007d34807642