“Salt Typhoon” Hackers from China Exploit Exchange Vulnerabilities to Attack Organizations

Salt Typhoon, a sophisticated Chinese Advanced Persistent Threat (APT) group, has been actively targeting critical sectors such as telecommunications and government entities across the globe.

Known by various aliases including FamousSparrow, GhostEmperor, Earth Estries, and UNC2286, this group has been engaged in espionage campaigns since at least 2019.

Their operations have expanded significantly, focusing on service providers supporting government and telecommunications organizations by 2022.

Salt Typhoon is distinguished by its high-level resources and advanced cyberespionage capabilities, employing multiple backdoors and hacking tools to maintain persistent access while minimizing detection.

Exploitation Techniques and TTPs

Salt Typhoon’s tactics, techniques, and procedures (TTPs) include exploiting Microsoft Exchange’s ProxyLogon vulnerabilities, which allow attackers to take over Exchange servers without requiring valid credentials.

They leverage PowerShell downgrade attacks to bypass Windows Antimalware Scan Interface (AMSI) logging, and utilize public cloud services like GitHub and Gmail for covert command and data exchange.

The group also employs various techniques for persistence, such as creating registry entries and scheduled tasks, and uses methods like process injection and DLL hijacking to evade detection and maintain control over compromised systems.

AttackIQ has developed an assessment template that emulates Salt Typhoon’s post-compromise TTPs, enabling organizations to validate their security controls against these sophisticated threats.

This template includes scenarios for execution, persistence, privilege escalation, defense evasion, credential access, discovery, lateral movement, and command and control.

By using this template, security teams can assess their ability to detect and prevent Salt Typhoon’s tactics, enhancing their overall security posture against this disruptive threat.

Mitigation and Detection Strategies

To counter Salt Typhoon’s attacks, organizations should focus on detecting and mitigating specific techniques such as DLL side-loading and scheduled tasks.

Monitoring for unusual process behavior and DLL loading events can help identify compromised systems.

Implementing software updates, auditing task scheduler activities, and enforcing robust password policies are crucial mitigation strategies.

Additionally, enhancing operating system configurations and managing privileged accounts can further reduce the risk of these attacks.

By prioritizing these measures, organizations can improve their resilience against Salt Typhoon’s sophisticated cyber threats.

Also Read:

Babuk Ransomware Group Claims Attack on Orange Telecom

See more