Volt Typhoon

Volt Typhoon is a Chinese state-sponsored threat actor. The content describes it as a China-linked operation and, in one reference, as military cyber actors. Known aliases in the provided content are Bronze Silhouette, DEV-0391, Insidious Taurus, Storm-0391, UNC3236, Vanguard Panda, Volt Typhoon, and Voltzite. The group is described as infiltrating U.S. critical infrastructure, including targets such as water treatment plants, the electrical grid, transportation systems, and U.S. military installations overseas. The content also states that Volt Typhoon infiltrated U.S. infrastructure as part of broader Chinese cyber activity and that its operations were intended to position for disruption or sabotage in a future conflict. Tradecraft directly mentioned in the content includes use of valid accounts and built-in operating system utilities, with initial access via exploitation of edge-device vulnerabilities. In victim environments, Volt Typhoon conducted hands-on-keyboard activity through the Windows command line; used PowerShell for remote system discovery; leveraged WMIC for execution, remote system discovery, and temporary directory creation; queried the Registry, including reg query hklm\software, to identify installed software such as PuTTY; enumerated running processes with Tasklist; obtained system location, screen dimension, and display device information; and used PowerShell Get-EventLog security -instanceid 4624 to identify associated user and computer account names. For credential and data access, the content states that Volt Typhoon attempted to obtain credentials from OpenSSH, RealVNC, and PuTTY; targeted network administrator browser data including browsing history and stored credentials; stole files from a sensitive file server; stole the Active Directory database including ntds.dit and the SYSTEM and SECURITY Registry hives; and used Wevtutil to extract event log information. The actor also used legitimate network and forensic tools and customized versions of open-source tools for command and control, and used legitimate-looking filenames such as cisco_up.exe, cl64.exe, vm3dservice.exe, watchdogd.exe, Win.exe, WmiPreSV.exe, and WmiPrvSE.exe for the Earthworm and Fast Reverse Proxy tools. Cleanup behavior mentioned includes use of rd /S to delete working directories and deletion of systeminfo.dat from C:\Users\Public\Documentsfiles. The content also states that Volt Typhoon used compromised hardware, including routers, and that the FBI disrupted a botnet of hundreds of U.S.-based small office and home routers associated with the operation.