attack-path / energy & utilities / ot-lotl-critical-infra

OT - Volt Typhoon AA24-038A

Engine-driven compliance rail for OT/ICS living-off-the-land intrusion -> critical-infrastructure pre-positioning (Volt Typhoon) on the Energy & Utilities protect-surface layout. Step controls cycle through the engine's Trust-Failure chain; each step shows the in-scope provisions the failure implicates and, where a regulatory clock applies, the obligation diamond.

advisoryCISA · Joint Cybersecurity Advisory AA24-038A — PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure (AA24-038A (2024-02-07))

resolved atEnergy & Utilities · OT cell (Purdue Model) · Remote user opens a SaaS application

step 01TF6observedATT&CK T1190

stage 6

Initial access via vulnerable public-facing networking appliances. AA24-038A: "To obtain initial access [TA0001], Volt Typhoon actors commonly exploit vulnerabilities in networking appliances such as those from Fortinet, Ivanti Connect Secure (formerly Pulse Secure), NETGEAR, Citrix, and Cisco [T1190]." The advisory also documents repurposing end-of-life Cisco/NETGEAR SOHO routers as KV-Botnet C2 proxies. The externally reachable device is exploited without a gating PEP — an Enforcement Failure at the network edge.

mitigating controls

ztna-gatewaydlpsiem-soarca-pkikms-secretspam

in-scope provisions (6)

partial§226.4 Substantial cyber incidentcirciadisc:highpendingEvidence
partial3.I - Implement Logical/Physical Network Segmentationcisa-cpgs-v2disc:highpendingEvidence
partialCIP-003-9 R2 — Low-impact cyber security plannerc-cipdisc:highpendingEvidence
partialPR.AA-01 — Identity Management, Authentication, and Access Controlnist-csf-2-0disc:highpendingEvidence
partialPR.AA-02 — Identity Management, Authentication, and Access Controlnist-csf-2-0disc:highpendingEvidence
partialPR.AA-03 — Identity Management, Authentication, and Access Controlnist-csf-2-0disc:highpendingEvidence

obligation

no regulatory clock for this step

protect-surface storyline (DAAS cards)

01
Initial Access
firewalls
Initial access through a vulnerable public-facing edge device (the network appliances and small-office routers Volt Typhoon is documented exploiting and repurposing). Exploited without a gating PEP — an Enforcement Failure at the network edge.
02
Credential Access
eng-workstation
LSASS process dumped via the native comsvcs.dll; Mimikatz harvests credentials on a foothold engineering workstation. The actor then operates as valid accounts (T1078) — the PE accepts credentials that no longer identify the legitimate principal.
03
Lateral Movement
servers
Living-off-the-land tradecraft (legitimate Windows binaries: wmic, ntdsutil, netsh) blends with normal administration; the actor moves east-west across the IT estate with minimal new tooling — designed to evade OT-IDS signature visibility.
04
Persistence (multi-year)
industrial-fw
Long-dwell persistence in the IT-OT DMZ. AA24-038A documents multi-year valid-account residency where the trust algorithm never re-decisions on session freshness — the adversary is the new "normal."
05
OT Pre-positioning
plc-controllers
Pre-positioning for disruptive impact on operational-technology controls. AA24-038A is explicit: the goal is the OPTION to disrupt critical infrastructure on demand, not an immediate action — which makes the eviction window the defender’s primary loss.

Compliance rail (text fallback)

Step 1 — TF6 (stage 6) · ATT&CK T1190 · evidence: observed

Initial access via vulnerable public-facing networking appliances. AA24-038A: "To obtain initial access [TA0001], Volt Typhoon actors commonly exploit vulnerabilities in networking appliances such as those from Fortinet, Ivanti Connect Secure (formerly Pulse Secure), NETGEAR, Citrix, and Cisco [T1190]." The advisory also documents repurposing end-of-life Cisco/NETGEAR SOHO routers as KV-Botnet C2 proxies. The externally reachable device is exploited without a gating PEP — an Enforcement Failure at the network edge.
- Mitigating controls: ztna-gateway, dlp, siem-soar, ca-pki, kms-secrets, pam
- Provisions in scope: circia#226.4 (partial, disc:high, pendingEvidence); cisa-cpgs-v2#3.I (partial, disc:high, pendingEvidence); nerc-cip#CIP-003-9-R2 (partial, disc:high, pendingEvidence); nist-csf-2-0#PR.AA-01 (partial, disc:high, pendingEvidence); nist-csf-2-0#PR.AA-02 (partial, disc:high, pendingEvidence); nist-csf-2-0#PR.AA-03 (partial, disc:high, pendingEvidence)
Step 2 — TF2 (stage 2) · ATT&CK T1003.001 · evidence: observed

Credential access via LSASS process-memory dump. AA24-038A: "actors downloaded [T1105] an outdated version of comsvcs.dll on the DC in a non-standard folder ... used this DLL with MiniDump and the process ID of the Local Security Authority Subsystem Service (LSASS) to dump the LSASS process memory [T1003.001] and obtain credentials." The advisory also documents NTDS.dit extraction [T1003.003] "in some cases multiple times from the same victim over long periods" and use of Mimikatz and Impacket. The PE later accepts these credentials as valid accounts (T1078) — the Identity Failure where the principal logging in is no longer the legitimate one.
- Mitigating controls: idp, mfa-authenticator, ca-pki, kms-secrets, pam
- Provisions in scope: cisa-cpgs-v2#3.A (partial, disc:high, pendingEvidence); cisa-cpgs-v2#3.B (partial, disc:high, pendingEvidence); cisa-cpgs-v2#3.F (partial, disc:high, pendingEvidence); cisa-cpgs-v2#3.G (partial, disc:high, pendingEvidence); nist-csf-2-0#PR.AA-01 (partial, disc:high, pendingEvidence); nist-csf-2-0#PR.AA-02 (partial, disc:high, pendingEvidence)
Step 3 — TF4 (stage 4) · ATT&CK T1059 · evidence: observed

Living-off-the-land tradecraft. AA24-038A: "Volt Typhoon actors rarely use malware for post-compromise execution. Instead, once Volt Typhoon actors gain access to target environments, they use hands-on-keyboard activity via the command-line [T1059] and other native tools and processes on systems [T1218] (often referred to as 'LOLBins'), known as LOTL, to maintain and expand access to the victim networks." The activity blends with legitimate administration and reaches the PE with no anomalous signal — a Context Failure, and the defining characteristic of this intrusion set.
- Mitigating controls: idp
- Provisions in scope: circia#226.4 (partial, disc:high, pendingEvidence); nist-csf-2-0#ID.AM-07 (partial, disc:high, pendingEvidence); nist-csf-2-0#ID.RA-01 (partial, disc:high, pendingEvidence); nist-csf-2-0#ID.RA-02 (partial, disc:high, pendingEvidence); nist-csf-2-0#ID.RA-03 (partial, disc:high, pendingEvidence); nist-csf-2-0#ID.RA-04 (partial, disc:high, pendingEvidence)
Step 4 — TF6 (stage 6) · ATT&CK T1021 · evidence: observed

Lateral movement via valid administrator credentials to reach additional systems, including IT hosts adjacent to operational-technology environments. AA24-038A documents Volt Typhoon "leveraging a compromised administrator account" via RDP and using PuTTY profiles enumerated on a vCenter server "for water treatment plants, water wells, an electrical substation, OT systems, and network security devices" to enable cross-segment access. Where IT and OT are not segmented behind east-west enforcement, the actor advances toward control systems without traversing a PEP — an Enforcement Failure.
- Mitigating controls: ztna-gateway, dlp, siem-soar, ca-pki, kms-secrets, pam
- Provisions in scope: circia#226.4 (partial, disc:high, pendingEvidence); cisa-cpgs-v2#3.I (partial, disc:high, pendingEvidence); nerc-cip#CIP-003-9-R2 (partial, disc:high, pendingEvidence); nist-csf-2-0#PR.AA-01 (partial, disc:high, pendingEvidence); nist-csf-2-0#PR.AA-02 (partial, disc:high, pendingEvidence); nist-csf-2-0#PR.AA-03 (partial, disc:high, pendingEvidence)
Step 5 — TF7 (stage 7) · ATT&CK T1078 · evidence: observed

Long-dwell persistence on valid accounts. AA24-038A: "the U.S. authoring agencies have recently observed indications of Volt Typhoon actors maintaining access and footholds within some victim IT environments for at least five years." Per the advisory, the actors "exhibit minimal activity within the compromised environment (except discovery as noted above), suggesting their objective is to maintain persistence rather than immediate exploitation" — with no continuous re-decisioning loop terminating the session as posture or context changes, that long-dwell persistence is a Session Failure.
- Mitigating controls: idp, edr-xdr, mdm-uem, ztna-gateway, dlp, siem-soar, kms-secrets, pam, cdm
- Provisions in scope: cisa-cpgs-v2#2.B (partial, disc:high, pendingEvidence); cisa-cpgs-v2#3.O (partial, disc:high, pendingEvidence); cisa-cpgs-v2#3.Q (partial, disc:high, pendingEvidence); nerc-cip#CIP-008-6-R1 (partial, disc:high, pendingEvidence); nist-csf-2-0#DE.AE-02 (partial, disc:high, pendingEvidence); nist-csf-2-0#DE.AE-03 (partial, disc:high, pendingEvidence)
Step 6 — TF8 (stage 8) · ATT&CK T1070 · evidence: observed

Anti-forensics under cover of an Audit Failure, in service of disruptive pre-positioning. AA24-038A: "Volt Typhoon's operational security is enhanced by targeted log deletion to conceal their actions within the compromised environment." The assessed objective: "Volt Typhoon actors are pre-positioning themselves on IT networks to enable the disruption of OT functions across multiple critical infrastructure sectors" — the destructive act is the OPTION the adversary holds rather than an executed event, which makes the eviction window the defender's primary loss.
- Mitigating controls: edr-xdr, dlp, siem-soar, pam, iga, cdm
- Provisions in scope: circia#226.11 (partial, disc:high, pendingEvidence); circia#226.4 (partial, disc:high, pendingEvidence); circia#226.5 (partial, disc:high, pendingEvidence); cisa-cpgs-v2#3.O (partial, disc:high, pendingEvidence); cisa-cpgs-v2#3.Q (partial, disc:high, pendingEvidence); nerc-cip#CIP-008-6-R1 (partial, disc:high, pendingEvidence)