The Bad Penny That Won’t Go Away: Volt Typhoon’s Relentless Cyber Assault on U.S. Infrastructure

Volt Typhoon, a sophisticated Chinese APT group, has recently been linked to a zero-day attack on Versa Networks, a software provider integral to managing SD-WAN infrastructure. This attack underscores the group’s relentless focus on penetrating U.S. CNI, specifically through vulnerabilities in networking equipment and software that are critical to the functioning of internet service providers (ISPs) and managed service providers (MSPs). These providers support not only the backbone of U.S. telecommunications but also small to mid-sized businesses that are vital to the economy.

The implications of such an attack are profound. If Volt Typhoon were to leverage its access to trigger a "kill switch," the consequences could be catastrophic, potentially disrupting U.S. telecommunications and internet services on a massive scale. This would not only cripple communications domestically but also have global ramifications, especially in scenarios of geopolitical conflict involving the U.S. and China.

Understanding the Attack on Versa Networks

In June 2024, Volt Typhoon exploited a zero-day vulnerability in Versa Director, a key component of Versa Networks’ software suite. This software is widely used by ISPs and MSPs to manage complex networking environments. The vulnerability, identified as CVE-2024-39717, allowed the attackers to upload malicious code, specifically a web shell dubbed "VersaMem," into the memory of the Tomcat server that hosts Versa Director. This sophisticated attack bypassed traditional security measures, allowing Volt Typhoon to steal credentials and potentially compromise downstream client infrastructure.

The targeted nature of this attack, involving critical U.S. ISPs and global IT firms, highlights the strategic value that Volt Typhoon places on these entities. The ability to disrupt or control such infrastructure could provide a significant tactical advantage in any future conflict, particularly in cutting off or manipulating communications between the U.S. and its allies in Asia.

The Limitations of Current Cybersecurity Measures

The persistent threat posed by Volt Typhoon and similar APT groups raises serious questions about the efficacy of current cybersecurity defences. Traditional methods, such as upgrading to the latest operating systems or deploying expensive AI-powered multi-layer defences like EDR (Endpoint Detection and Response) or XDR (Extended Detection and Response), have proven insufficient against zero-day vulnerabilities. The attack on Versa Networks exemplifies this, as the vulnerability exploited by Volt Typhoon was unknown and therefore unprotected by existing defences.

While solutions like Cylance claim to stop 98% of known malware, this still leaves a significant number—approximately 18 million malware samples based on 2022 figures—that could potentially bypass these protections. Moreover, the constant evolution of malware, with 300,000 new variants emerging daily, exacerbates this challenge.

The Case for Immutable Systems

Given the shortcomings of current cybersecurity approaches, particularly in protecting legacy systems prevalent in CNI, a paradigm shift is necessary. One of the most promising strategies is the adoption of immutable operating systems, where the core system files cannot be altered once deployed. This approach significantly reduces the attack surface, as any attempt to inject or modify malware at the system level would be automatically blocked.

Implementing an immutable OS, such as those offered by Abatis, enables organizations to create a genuine zero-trust environment, bridging the gap between patching cycles and providing robust protection against zero-day vulnerabilities. This method also helps control escalating cybersecurity costs, which have skyrocketed in the ongoing arms race between defenders and attackers.

The Strategic Imperative

As cyber threats from state-sponsored actors like Volt Typhoon continue to grow, the need for proactive and innovative defense strategies becomes more urgent. The traditional “detect, respond, and mitigate” approach must evolve to incorporate more resilient and foolproof methods, such as immutability and zero-trust architectures.

The stakes are incredibly high—by 2025, cybercrime is expected to cost the world $10.5 trillion annually. For U.S. CNI, the risk is not just financial but existential. Without significant changes in how these systems are protected, the possibility of a successful, large-scale cyberattack becomes more likely, with potentially devastating consequences for national security and economic stability.

The time to act is now. As the Chinese APT group Volt Typhoon has demonstrated, the adversaries are not only skilled but also persistent. The defences against them must be equally robust and adaptive, leveraging the best technology and practices available to secure our critical infrastructure against the inevitable cyber onslaught.

About the Author

Alexander Rogan is CEO at Abatis Security Innovations & Technologies GmbH and Platinum High Integrity Technologies Limited. He specializes in strategic management and cybersecurity, with a focus on protecting critical infrastructures from both kinetic and cyber threats. Connect with him on LinkedIn for more insights on cybersecurity trends and best practices.

?