FBI Warns Volt Typhoon Threatens US Infrastructure
FBI Director Wray warns Chinese state-sponsored hackers, including Volt Typhoon, have pre-positioned in US critical infrastructure networks for potential future disruption.
Sourcefbi.gov — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
FBI Director Christopher Wray, speaking at the Vanderbilt Summit on Modern Conflict and Emerging Threats, described the Chinese government's cyber activity against U.S. critical infrastructure as broad and unrelenting. He cited historical examples including 2011 reconnaissance against 23 pipeline operators, the 2021 Microsoft Exchange Server mass-exploitation campaign that deployed webshells across numerous sectors, and the more recent Volt Typhoon intrusions into telecommunications, energy, water, and other infrastructure networks, which the FBI assessed as pre-positioning for potential future disruptive attacks tied to tensions over Taiwan.
Wray detailed FBI-led disruption efforts, including a court-authorized operation with Microsoft to remove webshells from compromised Exchange servers, and a separate court-authorized operation to remove Volt Typhoon malware from infected routers and sever the actor's control of that botnet. He also referenced the SolarWinds supply-chain compromise as an example of hardware/software supply chain risk requiring vendor vetting.
The remarks are primarily a policy and awareness speech emphasizing public-private partnership, incident reporting, and resiliency planning rather than a new technical disclosure. No new indicators of compromise or vulnerabilities were disclosed; the piece reiterates known campaigns (Volt Typhoon, Exchange webshell attacks, SolarWinds) as illustrative examples of the sustained Chinese state-sponsored threat to U.S. critical infrastructure sectors.
Mentioned in this report
Detection guidance
Web Shell Deployment via Compromised Exchange Server
A behavioural hunt for the technique in general.
Detects suspicious file write or execution activity in Exchange Server web directories typical of webshell post-exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Web Shell Deployment via Compromised Exchange Server
description: Detects file creation or modification in Exchange Server web application
paths (ECP, OWA, etc.) with executable extensions, typical of post-exploitation
webshell staging following supply-chain compromise or direct exploitation.
tags:
- attack.persistence
- attack.t1505.003
logsource:
category: file_event
product: windows
detection:
selection:
TargetFilename|contains:
- \Exchange\FrontEnd\HttpProxy\ecp\
- \Exchange\FrontEnd\HttpProxy\owa\
- \inetpub\wwwroot\
TargetFilename|endswith:
- .aspx
- .asp
- .jsp
- .jspx
- .php
filter_legitimate_patching:
Image|endswith:
- \w3wp.exe
- \svchost.exe
- \update.exe
condition: selection and not filter_legitimate_patching
falsepositives:
- Legitimate Exchange Server patching and maintenance operations
- Authorized security scanning or web application deployment
level: high
id: 5bdefe7b-c1bd-5220-8916-1cb2ae0cd13c
status: experimental
author: Vorant
Suspicious Command Execution from Exchange Web Paths
A behavioural hunt for the technique in general.
Detects command-line or script execution initiated from Exchange Server web application directories, indicative of webshell activity. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Command Execution from Exchange Web Paths
description: Detects process creation where the parent process or working directory
is rooted in Exchange Server web application directories (ECP, OWA), indicating
potential webshell execution post-compromise.
tags:
- attack.persistence
- attack.t1505.003
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith:
- \w3wp.exe
CommandLine|contains:
- cmd.exe
- powershell.exe
- wscript.exe
- cscript.exe
ParentCommandLine|contains:
- \Exchange\FrontEnd\HttpProxy\ecp\
- \Exchange\FrontEnd\HttpProxy\owa\
filter_exchange_maintenance:
Image|endswith:
- \update.exe
- \setup.exe
condition: selection and not filter_exchange_maintenance
falsepositives:
- Exchange Server diagnostic or maintenance scripts run via w3wp.exe
- Authorized administrative tools executed within web application context
level: high
id: 62c67bca-71ad-55e0-9d9a-e1bbe567262b
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.fbi.gov/news/stories/chinese-government-poses-broad-and-unrelenting-threat-to-u-s-critical-infrastructure-fbi-director-says
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the actors, malware, and campaigns it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs