Loading malware…
Volt Typhoon is a China-linked, state-sponsored threat actor tracked for stealthy intrusions into critical infrastructure and enterprise networks, particularly in the United States. Public reporting cited in the content states that U.S. and allied agencies and Microsoft disclosed the activity in May 2023, and that the actor has been active against U.S. critical infrastructure since at least 2021. Reported victim sectors include communications, energy, transportation, water and wastewater, the U.S. power system, and oil and gas pipelines; the content also notes targeting of telecommunications, government networks, enterprise environments, and Juniper routers.
The actor is consistently described as seeking long-term, covert access rather than immediate monetization, with activity assessed as strategic pre-positioning for possible disruptive or destructive cyber operations during a future crisis or conflict involving the United States. The content states that Volt Typhoon has collected operational insights into the electric grid, identified chokepoints, mapped dependencies and administrative pathways, and preserved access that could later support disruption of military mobilization, communications, logistics, and public confidence.
Tradecraft described in the content includes living-off-the-land techniques, use of legitimate administration tools, stolen credentials, normal remote-management protocols, Unix shell commands, low-noise persistence, and systemd modifications. Volt Typhoon is also described as using Operational Relay Box (ORB) networks and the KV Botnet to maintain stealthy, persistent access and obscure operations; the KV Botnet was later dismantled by defenders. Additional behavior directly mentioned includes obtaining a victim system’s current location.
The content attributes Volt Typhoon to PRC-sponsored activity and repeatedly frames it as one of the clearest examples of Chinese cyber pre-positioning in civilian critical infrastructure. It is associated with espionage, long-term surveillance, and contingency access aligned with China’s geopolitical objectives. High-confidence defensive implications mentioned in the source material include aggressive patching of edge and SOHO devices, segmentation of IT and OT networks, removal of unnecessary internet exposure, strong MFA, monitoring for long-term hidden access, TLS/certificate anomaly detection, behavioral analytics, and preparation of manual fallback procedures.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct technique documented for this family, organized by ATT&CK tactic.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Described as activity focused on quietly gaining and maintaining access inside critical infrastructure as preparation for a future crisis.
State-linked intrusion campaign referenced as an example of stealthy critical infrastructure pre-positioning using quiet, durable tradecraft.
Volt Typhoon is a Chinese state-sponsored cyber espionage campaign focused on prepositioning in U.S. critical infrastructure for potential disruption or intelligence gathering.
Volt Typhoon is a Chinese state-sponsored cyber espionage campaign targeting US critical infrastructure, aiming to preposition for potential disruption or intelligence gathering.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.