Volt Typhoon

Summary

PRC state-sponsored actor pre-positioning inside US critical infrastructure for disruptive/destructive impact during a future Taiwan-related crisis. CISA advisory AA24-038A (Five Eyes, Feb 2024) confirms multi-year dwell in communications, energy, transportation, and water/wastewater sectors — access maintained in some environments for at least five years. Tradecraft is exclusively living-off-the-land (LOLBins): wmic, netsh, ntdsutil, PowerShell, certutil, esentutl — no custom malware deployed. Uses FOFA (Chinese internet asset search engine) for pre-attack reconnaissance of exposed IT infrastructure. Personal emails of key network/IT staff targeted to bypass security logging. Operational infrastructure: KV Botnet of compromised SOHO devices (Cisco RV-series, NETGEAR ProSafe, Fortinet FortiGate); disrupted by FBI/Lumen Black Lotus Labs Jan 2024, and the botnet was rebuilt in late 2024 (SecurityScorecard, Lumen); no confirmed Volt Typhoon intrusion has been publicly dated after 2024 — 2025 Dragos VOLTZITE reporting shares only technical overlaps. Fortinet: group exploits CVE-2023-27997 and edge device vulnerabilities for initial footholds. Microsoft/CrowdStrike joint taxonomy (Jun 2025) confirmed Volt Typhoon = BRONZE SILHOUETTE = Vanguard Panda = Insidious Taurus.

Attribution

No service publicly named

Named by a government: indictment, sanctions designation, joint advisory or official statement.

• NSA, CISA, FBI and partners (AA24-038A) (Government, 2024-02-07)
  Joint advisory: PRC state-sponsored actors pre-positioning in US critical infrastructure
• MITRE ATT&CK (MITRE ATT&CK, 2026-10)
  PRC state-sponsored actor

Campaigns 2

Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.

MITRE ATT&CK techniques 9

Malware and tools 3

Exploited vulnerabilities 1

Highest CVSS first.

Infrastructure patterns

• Compromised end-of-life SOHO routers (Cisco, NETGEAR) in the KV Botnet proxy its C2 (CISA, 2024; MITRE ATT&CK, 2026)

Reporting and advisories 7

• CISA
  AA23-144A — Volt Typhoon US Critical Infrastructure
• CISA
  AA24-038A — PRC Actors Compromise US Critical Infrastructure
• Dragos
  VOLTZITE threat group profile
• Microsoft
  Volt Typhoon Targets US Critical Infrastructure with LOTL Techniques
• DoJ (S.D. Texas)
  KV Botnet Disruption — U.S. government disrupts botnet the PRC used to conceal hacking of critical infrastructure (Jan 2024)
• Dragos
  Oil and Gas Cybersecurity: 2026 OT Threat Findings — VOLTZITE in U.S. midstream via Sierra Wireless gateways
• MITRE ATT&CK
  Volt Typhoon (G1017) group profile