Volt Typhoon

Primary tool for reconnaissance and command execution. Used with encoded commands to query AD, enumerate network shares, and gather system information without deploying malware.

Windows utility abused to create snapshots of the Active Directory database (NTDS.dit) for offline credential extraction and domain-wide access.

Used to configure port proxying and firewall rules on compromised systems, enabling traffic forwarding through operational relay networks.

Windows Management Instrumentation CLI used for remote process execution, system enumeration, and lateral movement without deploying additional tools.

Abused for file transfers (downloading tools from C2), Base64 encoding/decoding, and certificate manipulation on compromised systems.

Active Directory utility used to export directory data for offline analysis, mapping organizational structure and identifying high-value targets.

Open-source reverse proxy tool used to create encrypted tunnels from compromised networks to external C2 infrastructure, often with modified binaries.

Python toolkit used for wmiexec remote execution, secretsdump credential extraction, and SMB relay attacks during lateral movement phases.

Deployed sparingly for credential extraction. Volt Typhoon prefers NTDS.dit offline extraction to avoid triggering LSASS memory access alerts.

SOCKS5 proxy tool used to create multi-hop tunnels through compromised systems, enabling access to isolated network segments.

Command interpreter used to chain living-off-the-land binaries, execute batch scripts for reconnaissance, and manage compromised SOHO router access.

Compromises Fortinet FortiGuard, ASUS, Cisco, D-Link, Netgear, and Zyxel routers to create operational relay box (ORB) networks that proxy C2 traffic.

Network scanning tool used for initial reconnaissance of target infrastructure, port scanning, and service enumeration of critical infrastructure networks.

GUI-based network scanner used to map internal network topology, identify live hosts, and discover shared resources on compromised networks.

Sysinternals utility used for remote command execution on Windows systems. Enables lateral movement using harvested credentials.

Registry command-line tool used to query and modify registry keys for persistence, disabling security features, and extracting cached credentials.

Legitimate reverse proxy tool abused for command and control