{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/volt-typhoon/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":["Volt Typhoon","Vanguard Panda","Bronze Silhouette","Insidious Taurus"],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":[],"_cs_severities":["medium"],"_cs_tags":["persistence","command-and-control","living-off-the-land","windows","volt-typhoon"],"_cs_type":"threat","_cs_vendors":[],"content_html":"\u003cp\u003eThe Volt Typhoon threat actor group leverages the built-in Windows utility \u003ccode\u003enetsh.exe\u003c/code\u003e to configure network proxies on compromised hosts. By utilizing the \u003ccode\u003eportproxy\u003c/code\u003e and \u003ccode\u003ev4tov4\u003c/code\u003e command-line parameters, attackers can intercept and redirect network traffic to unauthorized destinations. This technique is frequently employed as a mechanism for maintaining persistence and establishing covert Command and Control (C2) channels. The use of native binaries for malicious purposes, often referred to as Living-off-the-Land (LotL), allows the actor to blend in with legitimate system administration activities and evade signature-based detection. Defenders must prioritize the monitoring of \u003ccode\u003enetsh.exe\u003c/code\u003e execution, specifically when it involves arguments related to port forwarding, to identify potential unauthorized network configuration changes.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker gains initial access to a target Windows system.\u003c/li\u003e\n\u003cli\u003eAttacker executes \u003ccode\u003enetsh.exe\u003c/code\u003e with administrative privileges.\u003c/li\u003e\n\u003cli\u003eAttacker runs \u003ccode\u003enetsh interface portproxy add v4tov4\u003c/code\u003e to define a new proxy listener.\u003c/li\u003e\n\u003cli\u003eThe system registers the listener, effectively creating a persistent network redirector.\u003c/li\u003e\n\u003cli\u003eThe proxy listener forwards inbound traffic to the specified C2 infrastructure.\u003c/li\u003e\n\u003cli\u003eAttacker maintains covert connectivity while minimizing the footprint of additional malicious binaries.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful implementation of this technique allows threat actors to maintain persistent, covert access to critical infrastructure. The primary risk involves the manipulation of network communications and the potential for long-term data exfiltration. If left unmonitored, this behavior facilitates unauthorized ingress into enterprise environments and provides a robust C2 channel for the actor to continue their operations undetected.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy the Sigma rule below to detect unauthorized \u003ccode\u003enetsh.exe\u003c/code\u003e usage and tune it against known administrative VPN clients.\u003c/li\u003e\n\u003cli\u003eEnable comprehensive process creation auditing (Sysmon Event ID 1 or Windows Event ID 4688) to capture command-line arguments.\u003c/li\u003e\n\u003cli\u003eFilter and alert on \u003ccode\u003enetsh.exe\u003c/code\u003e invocations containing \u003ccode\u003eportproxy\u003c/code\u003e or \u003ccode\u003ev4tov4\u003c/code\u003e parameters, as this activity is highly abnormal in standard operational environments.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-12T18:20:03Z","date_published":"2026-10-12T18:20:03Z","id":"https://feed.craftedsignal.io/briefs/2026-10-windows-proxy-via-netsh/","summary":"The Volt Typhoon group utilizes the Windows netsh utility to establish covert network proxies, enabling persistence and traffic redirection through the portproxy interface.","title":"Windows Proxy Configuration via Netsh","url":"https://feed.craftedsignal.io/briefs/2026-10-windows-proxy-via-netsh/"}],"language":"en","title":"CraftedSignal Threat Feed - Volt-Typhoon","version":"https://jsonfeed.org/version/1.1"}