Volt Typhoon

Also known as: VANGUARD PANDA, Bronze Silhouette, DEV-0391, Insidious Taurus, UNC3236, Redfly, Storm-0391, VOLTZITE

ActiveNation-StateChinaMITRE G1017

0Campaigns

73Techniques

31IOCs

37Tools

0Matches

3Infrastructure

Overview

Volt Typhoon is a Chinese state-sponsored threat actor focused on pre-positioning for potential disruptive or destructive operations against U.S. critical infrastructure. First publicly disclosed by Microsoft in May 2023, the group has been active since at least mid-2021 and represents a significant shift in Chinese cyber operations from traditional espionage to operational preparation of the environment (OPE). The group is characterized by its exclusive use of living-off-the-land (LOTL) techniques, avoiding custom malware in favor of built-in Windows tools, legitimate network administration utilities, and compromised SOHO routers as operational relay boxes (ORBs). This approach makes detection exceptionally difficult as the activity blends with normal administrative operations. Volt Typhoon has compromised organizations across communications, energy, transportation, and water/wastewater sectors. U.S. intelligence agencies assess that the group's operations are designed to maintain persistent access to critical infrastructure networks that could be leveraged for disruptive attacks during a potential Taiwan Strait crisis.

Motivations

Pre-positioningCritical Infrastructure AccessStrategic Deterrence

Target Sectors

Critical InfrastructureCommunicationsEnergyWater/WastewaterTransportationGovernmentDefense Industrial BaseMaritimeOil and GasManufacturingConstructionEducationInformation TechnologyTelecommunicationsAviationWater and Wastewater SystemsTransportation SystemsSingaporeAustraliaWater and WastewaterTransportation Systems SectorTransportation Systems and SectorRailWaterMilitaryITCritical Manufacturing

Activity Timeline

First Seen

Jan 2021

Last Seen

Jan 2024

Quick Facts

OriginChina

Sophisticationnation-state

StatusActive

MITRE GroupG1017

MITRE ATT&CK Techniques

(73)

Initial Access

T1190

Exploit Public-Facing Application

Exploit vulnerabilities in internet-facing applications to gain access.

T1133

External Remote Services

Abuse remote services like VPNs or RDP to gain access to the network.

T1078

Valid Accounts

Use legitimate credentials to authenticate and gain access.

T1189

Drive-by Compromise

Gain access through a user visiting a compromised website during normal browsing.

Execution

T1059.001

PowerShell

Use PowerShell commands and scripts for execution and automation.

T1059.003

Windows Command Shell

Use cmd.exe to execute commands and batch scripts.

T1059

Command and Scripting Interpreter

Abuse command-line interpreters and scripting languages to execute commands.

Other

Credential Access

T1003.001

LSASS Memory

Access LSASS process memory to extract credential material.

Discovery

T1046

Network Service Discovery

Scan for services running on remote hosts across the network.

T1018

Remote System Discovery

Discover remote systems on the network for lateral movement targets.

Command and Control

T1105

Ingress Tool Transfer

Download additional tools or payloads from an external system.

T1219

Remote Access Software

Use legitimate remote access tools like TeamViewer or AnyDesk for C2.

T1071

Application Layer Protocol

Communicate using application layer protocols like HTTP, DNS, or SMTP.

T1090

Proxy

Route C2 traffic through intermediary proxies to obscure the source.

Lateral Movement

T1021.001

Remote Desktop Protocol

Use RDP to connect to and control remote systems.

T1570

Lateral Tool Transfer

Transfer tools and files between compromised systems within the network.

Exfiltration

T1041

Exfiltration Over C2 Channel

Exfiltrate stolen data over the existing command and control channel.

Privilege Escalation

T1068

Exploitation for Privilege Escalation

Exploit software vulnerabilities to gain elevated privileges on a system.

Impact

T1489

Service Stop

Stop critical services to disrupt operations or aid in data destruction.

Collection

T1005

Data from Local System

Collect sensitive data stored on the local file system.

Resource Development

T1583

Acquire Infrastructure

Purchase or rent infrastructure such as servers, domains, or cloud services for operations.

Tools & Malware

(37)

PowerShell

os utilityLegitimate

Primary tool for reconnaissance and command execution. Used with encoded commands to query AD, enumerate network shares, and gather system information without deploying malware.

ntdsutil

os utilityLegitimate

Windows utility abused to create snapshots of the Active Directory database (NTDS.dit) for offline credential extraction and domain-wide access.

netsh

os utilityLegitimate

Used to configure port proxying and firewall rules on compromised systems, enabling traffic forwarding through operational relay networks.

wmic

os utilityLegitimate

Windows Management Instrumentation CLI used for remote process execution, system enumeration, and lateral movement without deploying additional tools.

certutil

os utilityLegitimate

Abused for file transfers (downloading tools from C2), Base64 encoding/decoding, and certificate manipulation on compromised systems.

ldifde

os utilityLegitimate

Active Directory utility used to export directory data for offline analysis, mapping organizational structure and identifying high-value targets.

FRP (Fast Reverse Proxy)

legitimate toolLegitimate

Open-source reverse proxy tool used to create encrypted tunnels from compromised networks to external C2 infrastructure, often with modified binaries.

Impacket

frameworkLegitimate

Python toolkit used for wmiexec remote execution, secretsdump credential extraction, and SMB relay attacks during lateral movement phases.

Mimikatz

frameworkLegitimate

Deployed sparingly for credential extraction. Volt Typhoon prefers NTDS.dit offline extraction to avoid triggering LSASS memory access alerts.

Earthworm

legitimate toolLegitimate

SOCKS5 proxy tool used to create multi-hop tunnels through compromised systems, enabling access to isolated network segments.

cmd.exe

os utilityLegitimate

Command interpreter used to chain living-off-the-land binaries, execute batch scripts for reconnaissance, and manage compromised SOHO router access.

SOHO Router Exploitation

exploit kitMalicious

Compromises Fortinet FortiGuard, ASUS, Cisco, D-Link, Netgear, and Zyxel routers to create operational relay box (ORB) networks that proxy C2 traffic.

Nmap

legitimate toolLegitimate

Network scanning tool used for initial reconnaissance of target infrastructure, port scanning, and service enumeration of critical infrastructure networks.

Advanced IP Scanner

legitimate toolLegitimate

GUI-based network scanner used to map internal network topology, identify live hosts, and discover shared resources on compromised networks.

PsExec

legitimate toolLegitimate

Sysinternals utility used for remote command execution on Windows systems. Enables lateral movement using harvested credentials.

reg.exe

os utilityLegitimate

Registry command-line tool used to query and modify registry keys for persistence, disabling security features, and extracting cached credentials.

Fast Reverse Proxy (FRP)

OtherLegitimate

Legitimate reverse proxy tool abused for command and control

ntlmrelayx

OtherLegitimate

NTLM relay attack tool used for credential relay attacks

PowerShell Empire

OtherMalicious

Post-exploitation framework occasionally used for command execution

Fast Reverse Proxy

OtherLegitimate

Open-source reverse proxy tool used to establish C2 channels

WMI

OtherLegitimate

Windows Management Instrumentation used for system management and lateral movement

NTDSDump

OtherLegitimate

Tool used to extract password hashes from Active Directory NTDS.dit files

WinRM

OtherLegitimate

Windows Remote Management protocol used for lateral movement within compromised networks

Wget

OtherLegitimate

Command-line utility used for downloading files and payloads

WinRAR

OtherLegitimate

Compression utility used for archiving data before exfiltration

Winmail

OtherLegitimate

Command-line mail client used for email collection and exfiltration

FastReverseProxy

OtherLegitimate

Legitimate reverse proxy tool repurposed to maintain persistence and facilitate command and control

Cobalt Strike

OtherLegitimate

Commercial penetration testing framework repurposed for post-exploitation activities

NetScan

OtherLegitimate

Network scanning tool used for reconnaissance and identifying targets

Powercat

OtherLegitimate

PowerShell version of netcat used for command and control communications

ADRecon

OtherLegitimate

Active Directory reconnaissance tool used to gather information about AD environments

AdFind

OtherLegitimate

Active Directory enumeration tool used for network reconnaissance

Commando VM

OtherLegitimate

Windows-based penetration testing distribution observed in Volt Typhoon operations

secretsdump

OtherLegitimate

Impacket tool used to extract credentials from Windows systems

PuTTY

OtherLegitimate

SSH and telnet client used for remote access and tunneling

WMI Command-line (WMIC)

OtherLegitimate

Windows Management Instrumentation command-line utility used for system reconnaissance and lateral movement

KdcSponge

StealerMalicious

Custom credential stealer that intercepts Kerberos authentication traffic on compromised domain controllers

Indicators of Compromise

(31)

IOC values are defanged for safety

Type	Value	Notes
ip	`104[.]161[.]54[.]203`	Compromised SOHO router used as relay infrastructure
ip	`185[.]106[.]92[.]12`	Operational relay box (ORB) infrastructure
domain	`gosloede[.]com`	C2 domain identified in critical infrastructure targeting
hash	`baeffeb5fdef2f42a752c65c2d2a52e84fb57efc906d981f89dd518c314e231c`	Modified FRP binary used for tunneling (SHA-256)
ip	`45[.]32[.]141[.]138`	Command and control infrastructure associated with Volt Typhoon operations
ip	`198[.]13[.]35[.]214`	Infrastructure used in critical infrastructure targeting
ip	`64[.]78[.]97[.]130`	C2 IP address associated with compromised SOHO router infrastructure
ip	`198[.]23[.]178[.]66`	Operational relay box IP used for KV-botnet infrastructure
domain	`office365[.]qnapnas[.]org`	Malicious domain used in compromised router infrastructure
ip	`103[.]95[.]223[.]194`	C2 infrastructure associated with Volt Typhoon operations
ip	`202[.]182[.]112[.]108`	Compromised SOHO router used as operational relay box
domain	`service[.]microsofts[.]cloud`	Malicious domain masquerading as legitimate Microsoft service
ip	`103[.]41[.]204[.]169`	Command and control infrastructure associated with Volt Typhoon operations
domain	`cisco-helpdesk[.]com`	Malicious domain used in Volt Typhoon phishing operations
ip	`45[.]32[.]180[.]94`	C2 infrastructure associated with Volt Typhoon operations
ip	`149[.]28[.]87[.]125`	C2 infrastructure associated with Volt Typhoon operations
domain	`nylatest[.]com`	Domain used in Volt Typhoon infrastructure
ip	`103[.]159[.]132[.]108`	Compromised SOHO router IP used as operational relay box
ip	`45[.]142[.]212[.]61`	Infrastructure associated with Volt Typhoon operations
ip	`103[.]172[.]115[.]115`	Compromised SOHO router used for C2 proxy
ip	`165[.]232[.]169[.]164`	Command and control infrastructure associated with Volt Typhoon operations
ip	`146[.]70[.]106[.]93`	Compromised SOHO router used as operational relay box
domain	`texasstarconcreteandstucco[.]com`	Compromised website used in command and control infrastructure
ip	`103[.]41[.]88[.]37`	C2 infrastructure associated with Volt Typhoon operations
ip	`161[.]35[.]137[.]12`	Compromised SOHO router used as operational relay box
domain	`msupdate[.]us`	Domain used for C2 communications mimicking Microsoft update infrastructure
ip	`174[.]127[.]99[.]234`	SOHO router IP used as operational relay box
ip	`61[.]244[.]116[.]66`	Infrastructure associated with Volt Typhoon operations
domain	`download[.]nvidia[.]us`	Typosquat domain used in Volt Typhoon infrastructure
ip	`103[.]159[.]132[.]138`	Command and control infrastructure associated with Volt Typhoon operations
ip	`154[.]223[.]151[.]178`	C2 server used in critical infrastructure targeting

Infrastructure

(3)

Domain values are defanged for safety

Domain / Host	Type	Status	Last Checked
`104[.]161[.]54[.]203` Compromised SOHO router used as relay infrastructure	ip	offline	Apr 2, 2026
`185[.]106[.]92[.]12` Operational relay box (ORB) infrastructure	ip	offline	Apr 2, 2026
`gosloede[.]com` C2 domain identified in critical infrastructure targeting	c2	offline	Apr 2, 2026

Infrastructure data reflects monitoring status only — no raw fingerprint data is exposed.

References

(142)

Microsoft - Volt Typhoon targets US critical infrastructure

https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/

CISA - PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure

https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-038a

CrowdStrike - VANGUARD PANDA

https://www.crowdstrike.com/blog/falcon-complete-thwarts-vanguard-panda-tradecraft/

Dragos 2026 OT/ICS Cybersecurity Year in Review - VOLTZITE Elevated to Stage 2

https://www.dragos.com/resources/press-release/dragos-2026-year-in-review-new-ot-threats-ransomware

Volt Typhoon Maintained Access to Massachusetts Utility for 10 Months - The Record

https://therecord.media/volt-typhoon-hackers-utility-months

Microsoft Threat Intelligence - Volt Typhoon Targets US Critical Infrastructure

https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques

Dragos: Researchers Warn Volt Typhoon Still Embedded in US Utilities - The Record

https://therecord.media/researchers-warn-volt-typhoon-still-active-critical-infrastructure

CISA Cybersecurity Advisory - PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-144a

NSA/FBI Joint Cybersecurity Advisory - People's Republic of China State-Sponsored Cyber Actor Living off the Land to Evade Detection

https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF

Secureworks - Bronze Silhouette Targets US Critical Infrastructure

https://www.secureworks.com/research/bronze-silhouette-targets-us-critical-infrastructure

Volt Typhoon - MITRE ATT&CK Group Profile

https://attack.mitre.org/groups/G1017/

Volt Typhoon: Analyzing Windows Proxy Logon Attack Targeting Hybrid Identity

https://www.sentinelone.com/labs/volt-typhoon-analyzing-windows-proxy-logon-attack-targeting-hybrid-identity/

Assessing Volt Typhoon's Capabilities and Operations

https://www.secureworks.com/blog/assessing-volt-typhoons-capabilities-and-operations

NCSC-NL Advisory: Volt Typhoon

https://www.ncsc.nl/actueel/advisory?id=NCSC-2024-0038

FBI and Partners Issue Advisory on Volt Typhoon Activity

https://www.fbi.gov/news/press-releases/fbi-and-partners-issue-advisory-on-volt-typhoon-activity

Secureworks: Volt Typhoon Exploits Zero-Day Vulnerability

https://www.secureworks.com/blog/volt-typhoon-exploits-zero-day-vulnerability

BlackLotus campaign: Analyzing the technical tactics of Volt Typhoon

https://www.secureworks.com/research/bronze-silhouette

Assessing the Tradecraft and Impact of the Volt Typhoon Intrusions

https://www.mandiant.com/resources/blog/volt-typhoon-tradecraft-us-critical-infrastructure

Singapore Names UNC3886 APT Targeting Critical Infrastructure - July 2025

https://en.wikipedia.org/wiki/Volt_Typhoon

Australia Warns of Volt Typhoon Infrastructure Targeting - November 2025

https://en.wikipedia.org/wiki/Volt_Typhoon

FBI KV Botnet Disruption - January 2024

https://therecord.media/china-run-botnet-takedown-fbi-doj-routers

Volt Typhoon Rebuilds KV Botnet After FBI Takedown - November 2024

https://www.bleepingcomputer.com/news/security/volt-typhoon-rebuilds-malware-botnet-following-fbi-disruption

NSA/FBI Joint Cybersecurity Advisory on Volt Typhoon

https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/joint_csa_protecting_against_prc_state_sponsored_cyber_activity.pdf

Black Lotus Labs: Volt Typhoon RCE Exploit Infrastructure Analysis

https://blog.lumen.com/volt-typhoon-rce-exploit-infrastructure/

Secureworks: Volt Typhoon Targets Critical Infrastructure

https://www.secureworks.com/blog/volt-typhoon-targets-critical-infrastructure

FBI Director Wray testimony on Volt Typhoon targeting critical infrastructure

https://www.fbi.gov/news/speeches/countering-threats-posed-by-the-chinese-government-inside-the-us-wray-013124

Secureworks: VOLTZITE Threat Profile

https://www.secureworks.com/research/threat-profiles/bronze-silhouette

FBI Director testifies on Volt Typhoon targeting of US critical infrastructure

https://www.fbi.gov/news/testimony/worldwide-threats-to-the-homeland-091724

Volt Typhoon: Analyzing Windows Proxy Logon Behavior for Detection

https://www.secureworks.com/blog/analyzing-windows-proxy-logon-behavior-for-detection

Volt Typhoon: Analysis and Protections

https://www.dragos.com/blog/industry-news/volt-typhoon-analysis-and-protections/

BREAKING THE SILENT SIEGE: Detecting Volt Typhoon and similar threat actors

https://www.secureworks.com/blog/breaking-the-silent-siege-detecting-volt-typhoon

FBI and Partners Dismantle KV Botnet Used by Volt Typhoon - January 2024

https://www.fbi.gov/news/press-releases/fbi-and-partners-dismantle-kv-botnet-used-by-peoples-republic-of-china-state-sponsored-cyber-actors-to-conceal-attacks-on-critical-infrastructure

Secureworks: BRONZE SILHOUETTE Targets US Critical Infrastructure

https://www.secureworks.com/blog/bronze-silhouette-targets-us-critical-infrastructure

Mandiant - Volt Typhoon: Espionage Campaign Targeting Critical Infrastructure in the Indo-Pacific

https://www.mandiant.com/resources/blog/volt-typhoon-targets-us-critical-infrastructure

NSA/FBI Joint Cybersecurity Advisory: PRC State-Sponsored Cyber Activity

https://media.defense.gov/2024/Feb/07/2003391170/-1/-1/0/JOINT_CSA_PRC_VOLT_TYPHOON.PDF

Volt Typhoon: Unraveling the Stealthy Threat

https://www.secureworks.com/research/volt-typhoon-targets-us-critical-infrastructure

NSA/FBI Joint Cybersecurity Advisory: PRC State-Sponsored Cyber Activity

https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/Joint_CSA_Living_off_the_Land.PDF

Mandiant - Volt Typhoon: Assessing The Threat To Critical Infrastructure

https://www.mandiant.com/resources/blog/volt-typhoon-assessing-threat

FBI Director Wray Testimony on Volt Typhoon

https://www.fbi.gov/news/speeches/worldwide-threats-to-the-homeland-031324

FBI Statement on PRC Targeting of US Critical Infrastructure

https://www.fbi.gov/news/press-releases/fbi-statement-on-prc-targeting-of-us-critical-infrastructure

FBI Director Christopher Wray Statement on Volt Typhoon - House Select Committee

https://www.fbi.gov/news/testimony/worldwide-threats-to-the-homeland-011824

Secureworks: VOLTZITE Targets US Critical Infrastructure

https://www.secureworks.com/research/voltzite-targets-us-critical-infrastructure

CISA: Understanding and Mitigating Volt Typhoon

https://www.cisa.gov/resources-tools/resources/understanding-and-mitigating-russian-state-sponsored-cyber-threats-us-critical-infrastructure

Volt Typhoon: Guam, Cyber Intrusions, and Infrastructure Resilience

https://www.mandiant.com/resources/blog/volt-typhoon-disrupts-critical-infrastructure

PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure

https://www.cisa.gov/sites/default/files/2024-02/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_2.pdf

FBI Director Wray Testimony on Volt Typhoon - U.S. House Select Committee

https://www.fbi.gov/news/testimony/worldwide-threats-to-the-homeland-011823

NSA Cybersecurity Advisory: PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure

https://media.defense.gov/2024/Feb/07/2003391726/-1/-1/0/JOINT-GUIDANCE-IDENTIFYING-AND-MITIGATING-LOTL.PDF

FBI warns Volt Typhoon targeting critical US infrastructure

https://www.cisa.gov/news-events/alerts/2024/02/07/updated-volt-typhoon-guidance

FBI disrupts Volt Typhoon botnet used to target US critical infrastructure

https://www.cisa.gov/news-events/alerts/2024/01/31/fbi-led-operation-disrupts-botnet-used-target-critical-infrastructure

NSA Cybersecurity Advisory: PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure

https://media.defense.gov/2024/Feb/07/2003391182/-1/-1/0/CSA-PRC-VOLT-TYPHOON.PDF

Secureworks: BRONZE SILHOUETTE Targets U.S. Critical Infrastructure

https://www.secureworks.com/blog/bronze-silhouette-targets-us-government-and-defense-organizations

FBI disrupts botnet China used to conceal hacking of critical infrastructure

https://www.justice.gov/opa/pr/fbi-disrupts-botnet-peoples-republic-china-used-conceal-hacking-critical-infrastructure

FBI and Partners Disrupt Volt Typhoon Botnet

https://www.fbi.gov/news/press-releases/fbi-and-partners-disrupt-volt-typhoon-botnet

Lumen Black Lotus Labs: KV-botnet Target Set Expands to US Critical Infrastructure

https://blog.lumen.com/kv-botnet-target-set-expands-to-us-critical-infrastructure/

Secureworks - BRONZE SILHOUETTE Targets U.S. Critical Infrastructure

https://www.secureworks.com/blog/chinese-cyberespionage-group-bronze-silhouette-targets-us-critical-infrastructure

NSA/FBI Joint Cybersecurity Advisory - PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure

https://media.defense.gov/2024/Feb/07/2003391170/-1/-1/0/Joint_CSA_PRC_CRITICAL_INFRASTRUCTURE_FEBRUARY_2024.PDF

Secureworks: VOLTZITE Uses Infrastructure from GRIM SPIDER Botnet

https://www.secureworks.com/blog/voltzite-infrastructure-from-grim-spider-botnet

FBI Director Christopher Wray Testimony on Volt Typhoon

https://www.fbi.gov/news/testimony/worldwide-threats-to-the-homeland-013124

Secureworks: VOLTZITE Espionage Campaign Targets Critical Infrastructure

https://www.secureworks.com/blog/voltzite-campaign-targets-us-critical-infrastructure

NSA Cybersecurity Advisory: PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure

https://media.defense.gov/2024/Feb/07/2003391170/-1/-1/0/CSA-PRC-LINKED-ACTORS-THREATEN-US-CRITICAL-INFRASTRUCTURE.PDF

NSA, CISA Release Guidance on Hunting Volt Typhoon Activity

https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/3638623/nsa-cisa-release-guidance-on-hunting-volt-typhoon-activity/

Black Lotus Labs Identifies Volt Typhoon KV-Botnet Activity

https://blog.lumen.com/kvbotnet-a-peek-under-the-hood-of-a-nation-state-grade-botnet/

Secureworks: BRONZE SILHOUETTE Seeks Targets in U.S. Critical Infrastructure Sectors

https://www.secureworks.com/blog/bronze-silhouette-seeks-targets-in-us-critical-infrastructure-sectors

FBI and partners disrupt Volt Typhoon botnet used to conceal PRC targeting of critical infrastructure

https://www.fbi.gov/news/stories/fbi-and-partners-disrupt-volt-typhoon-botnet

NSA/FBI Joint Advisory on Volt Typhoon Activity

https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/joint_csa_volt_typhoon.pdf

FBI Chief Says Chinese Hackers Preparing to Attack US Infrastructure

https://www.fbi.gov/news/speeches/chinas-multi-pronged-assault-on-our-national-and-economic-security

CISA Confirms Volt Typhoon Compromised Critical Infrastructure Organizations

https://www.cisa.gov/news-events/alerts/2024/02/07/cisa-confirms-volt-typhoon-compromised-critical-infrastructure-organizations

Secureworks - Bronze Silhouette Targets U.S. Critical Infrastructure

https://www.secureworks.com/research/bronze-silhouette-targets-us-government-and-defense-organizations

Secureworks: BRONZE SILHOUETTE Targets U.S. Critical Infrastructure

https://www.secureworks.com/blog/bronze-silhouette-targets-us-government-and-critical-infrastructure

Black Lotus Labs: Volt Typhoon Infrastructure Analysis

https://blog.lumen.com/volt-typhoon-and-the-threat-to-critical-infrastructure/

NSA Cybersecurity Advisory: PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure

https://media.defense.gov/2024/Feb/07/2003391466/-1/-1/0/CSA-PRC-LINKED-ACTORS-COMPROMISE-AND-MAINTAIN-PERSISTENT-ACCESS-TO-US-CRITICAL-INFRASTRUCTURE.PDF

Secureworks: Volt Typhoon Espionage Campaign Targets Critical Infrastructure

https://www.secureworks.com/blog/china-linked-volt-typhoon-campaign-targets-critical-infrastructure

Volt Typhoon: Analyzing Windows activity and information theft

https://www.secureworks.com/research/volt-typhoon

FBI warns critical infrastructure at risk from Chinese Volt Typhoon attacks

https://www.bleepingcomputer.com/news/security/fbi-warns-critical-infrastructure-at-risk-from-chinese-volt-typhoon-attacks/

Volt Typhoon: NCSC and international partners renew alert on PRC actors targeting critical national infrastructure

https://www.ncsc.gov.uk/news/volt-typhoon-targeting-critical-national-infrastructure

Guidance on the People's Republic of China's Volt Typhoon activity

https://www.ncsc.gov.uk/news/volt-typhoon-advisory

FBI disrupts botnet People's Republic of China used to conceal hacking of critical infrastructure

https://www.fbi.gov/news/press-releases/fbi-disrupts-botnet-peoples-republic-of-china-used-to-conceal-hacking-of-critical-infrastructure

FBI and Partners Issue Joint Cybersecurity Advisory on Volt Typhoon Activity

https://www.fbi.gov/news/press-releases/fbi-and-partners-disrupt-volt-typhoon

CISA: Volt Typhoon Activity Persists in U.S. Critical Infrastructure (February 2024)

https://www.cisa.gov/news-events/alerts/2024/02/07/cisa-releases-guidance-volt-typhoon-activity

NSA/FBI Joint Cybersecurity Advisory - PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure

https://media.defense.gov/2024/Feb/07/2003391917/-1/-1/0/JOINT-GUIDANCE-IDENTIFYING-AND-MITIGATING-LOTL.PDF

CISA: Joint Guidance on Enhanced Visibility and Hardening Guidance for Communications Infrastructure

https://www.cisa.gov/resources-tools/resources/enhanced-visibility-and-hardening-guidance-communications-infrastructure

BlackLotus UEFI bootkit is myth come to life

https://www.welivesecurity.com/2023/03/01/blacklotus-uefi-bootkit-myth-come-life/

NCSC-NL Advisory: Volt Typhoon targets critical infrastructure

https://www.ncsc.nl/actueel/advisory?id=NCSC-2024-0039

Secureworks: VOLTZITE Targets US Critical Infrastructure

https://www.secureworks.com/blog/voltzite-targets-us-critical-infrastructure

NCSC-NL: AIVD and MIVD investigate state actor targeting Dutch military networks

https://www.ncsc.nl/actueel/nieuws/2024/februari/6/aivd-en-mivd-onderzoeken-statelijke-actor-gericht-op-nederlandse-militaire-netwerken

NSA/FBI Joint Cybersecurity Advisory: PRC State-Sponsored Cyber Actors Living off the Land

https://media.defense.gov/2024/Feb/07/2003391172/-1/-1/0/CSA-PRC-LIVING-OFF-THE-LAND.PDF

FBI Director Wray warns on Volt Typhoon threat to US critical infrastructure

https://www.fbi.gov/news/speeches/the-cyber-threat-to-critical-infrastructure-013124

FLASH: Volt Typhoon Issued Joint Cybersecurity Advisory

https://www.cisa.gov/sites/default/files/2023-05/aa23-144a_csa_volt_typhoon_signed_508c.pdf

NSA/FBI Joint Cybersecurity Advisory: PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure

https://media.defense.gov/2024/Feb/07/2003391917/-1/-1/0/PRC-CRITICAL-INFRASTRUCTURE-ADVISORY-FINAL.PDF

NSA Cybersecurity Advisory: PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure

https://media.defense.gov/2024/Feb/07/2003391170/-1/-1/0/CSA-PRC-LINKED-ACTORS-BOTNET.PDF

CISA: Understanding and Mitigating Volt Typhoon Threat

https://www.cisa.gov/topics/cyber-threats-and-advisories/advanced-persistent-threats/china/volt-typhoon

Secureworks: Threat Profile - VOLTZITE

https://www.secureworks.com/research/threat-profiles/aluminum-typhoon

NCSC-UK: PRC State-Affiliated Cyber Actor Living off the Land to Evade Detection

https://www.ncsc.gov.uk/news/prc-state-affiliated-cyber-actor-living-off-the-land-to-evade-detection

FBI Director Christopher Wray testimony on Volt Typhoon targeting US infrastructure

https://www.fbi.gov/news/testimony/worldwide-threats-to-the-homeland-091824

FBI, CISA, NSA, and Partners Release Advisory on Volt Typhoon Activity

https://www.fbi.gov/news/press-releases/fbi-cisa-nsa-and-partners-release-advisory-on-volt-typhoon-activity

NSA Cybersecurity Advisory: PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure

https://media.defense.gov/2024/Feb/07/2003391170/-1/-1/0/CSA-PRC-LINKED-ACTORS-COMPROMISE-MAINTAIN-PERSISTENT-ACCESS-CRITICAL-INFRASTRUCTURE.PDF

NSA Cybersecurity Advisory: PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure

https://media.defense.gov/2024/Feb/07/2003391170/-1/-1/0/CSA-PRC-VOLT-TYPHOON.PDF

FBI Director Testimony on Volt Typhoon Critical Infrastructure Threat

https://www.fbi.gov/news/speeches/worldwide-threats-to-the-homeland-012024

Black Lotus Labs: KV-botnet infrastructure targeting SOHO routers

https://blog.lumen.com/kv-botnet-volt-typhoon-campaigns-and-infrastructure/

Joint Cybersecurity Advisory: PRC State-Sponsored Cyber Activity

https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/3404151/

Flax Typhoon using legitimate software to quietly access Taiwanese organizations

https://www.microsoft.com/en-us/security/blog/2023/08/24/flax-typhoon-using-legitimate-software-to-quietly-access-taiwanese-organizations/

FBI disrupts Chinese botnet targeting critical infrastructure

https://www.fbi.gov/news/press-releases/fbi-director-wray-statement-on-volt-typhoon-disruption

FBI Director Wray Testifies on Volt Typhoon Threat to US Critical Infrastructure

https://www.fbi.gov/news/testimony/worldwide-threats-to-the-homeland-031324

FLASH: Volt Typhoon Activity Targets US Critical Infrastructure

https://www.ic3.gov/Media/News/2023/230524.pdf

Joint Guidance: Identifying and Mitigating Living Off the Land Techniques

https://www.cisa.gov/resources-tools/resources/joint-guidance-identifying-and-mitigating-living-land-techniques

Hunting for Volt Typhoon: Detecting living-off-the-land cyber operations

https://www.ncsc.gov.uk/news/hunt-volt-typhoon-with-uk-agencies

Secureworks: VOLTZITE Espionage Campaign Targets Critical Infrastructure

https://www.secureworks.com/blog/voltzite-espionage-campaign-targets-critical-infrastructure

CISA: Volt Typhoon Activity Mitigations

https://www.cisa.gov/topics/cyber-threats-and-advisories/advanced-persistent-threats/volt-typhoon

FBI Director Testimony on Volt Typhoon Infrastructure Targeting

https://www.fbi.gov/news/testimony/worldwide-threats-to-the-homeland-091723

FBI removes PlugX malware from thousands of computers in Volt Typhoon disruption

https://www.justice.gov/opa/pr/fbi-releases-cyber-actor-s-botnet-comprised-hundreds-thousands-routers-and-network-storage

Microsoft: Volt Typhoon attack disrupted by joint effort

https://www.microsoft.com/en-us/security/blog/2024/01/31/threat-intelligence-report-on-voltzite-activity/

Secureworks: Volt Typhoon Targets US Critical Infrastructure

https://www.secureworks.com/blog/china-linked-volt-typhoon-targets-us-critical-infrastructure

NSA/FBI Joint Advisory - PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure

https://media.defense.gov/2024/Feb/07/2003391794/-1/-1/0/CSA-PRC-LINKED-ACTORS-KDLOT.PDF

CISA - Identifying and Mitigating Living Off the Land Techniques

https://www.cisa.gov/sites/default/files/2023-05/aa23-144a_csa_vtyphoon_checklist.pdf

FBI Director Wray Testifies on Volt Typhoon Threat to Critical Infrastructure

https://www.fbi.gov/news/testimony/worldwide-threats-to-the-homeland-031124

NSA/CISA Joint Advisory: Volt Typhoon - Detecting and Preventing Post-Compromise Threat Activity

https://media.defense.gov/2024/Feb/07/2003391906/-1/-1/0/JOINT-GUIDANCE-IDENTIFYING-AND-MITIGATING-LOTL.PDF

NSA Cybersecurity Advisory: PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure

https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/3399936/

Mandiant - Volt Typhoon: Widespread Compromise of US Critical Infrastructure

https://www.mandiant.com/resources/blog/volt-typhoon-us-critical-infrastructure

CISA Alert - PRC Cyber Activity Targeting Critical Infrastructure

https://www.cisa.gov/news-events/alerts/2024/02/07/prc-cyber-activity-targeting-critical-infrastructure

Volt Typhoon: Ongoing Activity Targeting Critical Infrastructure

https://www.cisa.gov/sites/default/files/2024-02/CSAC_TAA_Volt_Typhoon_508c.pdf

FLASH: Volt Typhoon

https://www.ncsc.gov.uk/files/NCSC-CISA-FBI-NSA-Volt-Typhoon-Advisory.pdf

Secureworks: Threat Profile - VOLTZITE

https://www.secureworks.com/research/threat-profiles/voltzite

Joint Cybersecurity Advisory: PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure

https://www.cisa.gov/news-events/alerts/2024/02/07/prc-state-sponsored-actors-compromise-and-maintain-persistent-access-us-critical-infrastructure

FBI Director Wray: China's hackers are preparing to wreak havoc on US critical infrastructure

https://www.cnn.com/2024/01/31/politics/fbi-director-china-hackers-critical-infrastructure/index.html

NSA/FBI Joint Cybersecurity Advisory: PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure

https://media.defense.gov/2024/Feb/07/2003391793/-1/-1/0/CSA-PRC-LINKED-ACTORS-COMPROMISE-US-CRITICAL-INFRASTRUCTURE.PDF

CISA: Volt Typhoon Guidance for All Critical Infrastructure Organizations

https://www.cisa.gov/sites/default/files/2024-02/CISA_Volt-Typhoon-Guidance_508c.pdf

Volt Typhoon: Evolving TTPs and New Targeting Observed

https://www.secureworks.com/blog/volt-typhoon-evolving-ttps-and-new-targeting

NSA Cybersecurity Advisory: PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure

https://media.defense.gov/2024/Feb/07/2003391796/-1/-1/0/CSA-PRC-LINKED-ACTORS-COMPROMISE-MAINTAIN-PERSISTENT-ACCESS-CRITICAL-INFRASTRUCTURE.PDF

Mandiant: Volt Typhoon Activity Targeting Critical Infrastructure

https://www.mandiant.com/resources/blog/volt-typhoon-critical-infrastructure

Black Lotus Labs: Cleaning House: Dismantling Volt Typhoon's KV Botnet

https://blog.lumen.com/cleaning-house-dismantling-volt-typhoons-kv-botnet/

FBI and Partners Dismantle KV-Botnet Used by People's Republic of China-Backed Hackers to Conceal Attacks on Critical Infrastructure

https://www.fbi.gov/news/press-releases/fbi-and-partners-dismantle-kv-botnet-used-by-peoples-republic-of-china-backed-hackers-to-conceal-attacks-on-critical-infrastructure

Analysing Volt Typhoon's tactics and techniques

https://www.ncsc.gov.uk/news/china-based-volt-typhoon-targets-us-critical-infrastructure

NSA Advisory: People's Republic of China State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure

https://media.defense.gov/2024/Feb/07/2003391917/-1/-1/0/CSA-PRC-VOLT-TYPHOON.PDF

Black Lotus Labs: Volt Typhoon RCE Exploit

https://blog.lumen.com/post-exploitation-in-the-wild-from-volt-typhoon/

Volt Typhoon: Analyzing Windows proxy logon logs

https://www.ncsc.gov.uk/news/volt-typhoon-campaign-targeting-critical-infrastructure

Black Lotus Labs: Volt Typhoon Campaign Targets Critical Infrastructure

https://blog.lumen.com/volt-typhoon-campaign-targets-critical-infrastructure/

CISA: Understanding and Mitigating Russian State-Sponsored Cyber Threats to U.S. Critical Infrastructure (includes Volt Typhoon analysis)

https://www.cisa.gov/sites/default/files/2024-02/Joint_CSA_Understanding_and_Mitigating_Russian_State-Sponsored_Cyber_Threats_to_US_Critical_Infrastructure_Final_508c.pdf

Black Lotus Labs: Volt Typhoon RapperBot Botnet Update

https://blog.lumen.com/new-rapperbot-variant-and-volt-typhoon-activity/

FBI and Partners Disrupt Volt Typhoon Botnet

https://www.justice.gov/opa/pr/fbi-and-partners-disrupt-volt-typhoon-botnet-prc-state-sponsored-hackers-used-infect

Hunting for Volt Typhoon Malicious Activity in Cyber Threat Intelligence

https://www.cisa.gov/sites/default/files/2024-02/CISA_Guidance-Hunting_for_Volt_Typhoon_Activity_in_CTI_508c.pdf

Black Lotus Labs Identifies Activity of Volt Typhoon Threat Actor in US

https://blog.lumen.com/volt-typhoon-the-persistent-threat/

NSA/FBI Joint Cybersecurity Advisory - PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure

https://media.defense.gov/2024/Feb/07/2003391169/-1/-1/0/JOINT-GUIDANCE-IDENTIFYING-AND-MITIGATING-LOTL.PDF