Loading story…
Dragos’ annual OT threat report warns that the China-linked Volt Typhoon operation (tracked by Dragos as Voltzite) continued compromising US critical infrastructure through 2025, including electric, oil, and gas organizations, by abusing edge devices such as cellular gateways and routers to gain and maintain long-term access. Dragos CEO Robert M. Lee said the activity is oriented toward pre-positioning for future disruption rather than intellectual property theft, with intrusions aimed at achieving persistence and, in some cases, getting “inside the control loop” of industrial processes.
US authorities and Dragos assess the strategic objective as establishing footholds in operational technology environments to enable destructive or disruptive attacks that could impede US response and military mobilization during a crisis. Lee also cautioned that some compromised sites in the US and allied countries may never be identified, particularly among smaller or less mature utilities (notably in the water sector), even as forthcoming US regulations over the next several years may improve detection and remediation capabilities across parts of the energy sector.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
Separately in the same report, Dragos attributed attacks on Poland's power grid to Electrum, which it said overlaps with Russia's GRU-linked Sandworm. It also described Kamacite as Electrum's initial access provider conducting reconnaissance scanning of U.S. industrial devices.
Dragos' annual report introduced Azurite, a group overlapping with Flax Typhoon and focused on OT workstation access and operational data theft, and Pyroxene, a group overlapping with Iran-linked Imperial Kitten/APT35 using supply-chain and social-engineering tactics. The disclosure expanded the set of state-linked actors tracked as targeting operational technology environments.
In its annual OT threat report, Dragos named SYLVANITE as a new threat group acting as an initial access broker for Volt Typhoon/Voltzite by exploiting edge-device vulnerabilities across sectors and geographies. The company said the group hands off access for follow-on operations against critical infrastructure.
Dragos linked recent exploitation of Ivanti and Trimble Cityworks vulnerabilities to Volt Typhoon and the related access-enablement group SYLVANITE. The activity may have enabled theft of GIS, sensor, and operational data useful for future disruptive attacks on electric and water utilities.
Dragos said the Volt Typhoon operation continued targeting U.S. utilities throughout 2025 and remained embedded in U.S. and allied critical infrastructure despite prior U.S. military and law-enforcement disruption efforts. Researchers warned some utility compromises may never be fully found or eradicated, especially in less mature sectors such as water.
During 2025, Dragos observed the JDY botnet scanning IP ranges and VPN appliances to identify targets for possible pre-positioning linked to Voltzite/Volt Typhoon activity. The scanning supported access-enablement efforts against critical infrastructure environments.
Dragos reported that the China-linked cluster it tracks as Voltzite used Sierra Wireless AirLink cellular gateways and routers to gain access toward pipeline operational technology networks. The activity affected U.S. electric, oil, and gas organizations and established long-term persistence that could enable later control-system manipulation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
securitysenses.com
Open sourcetherecord.media
Open sourcego.theregister.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft and U.S. government agencies disclosed that the Chinese state-linked threat group **Volt Typhoon** infiltrated critical infrastructure organizations in the United States and Guam, with activity affecting sectors including communications, manufacturing, utilities, transportation, construction, maritime, government, information technology, and education. The campaign relied on **living-off-the-land** techniques to blend into normal administrative activity, using valid accounts, built-in command-line tools, and network equipment to maintain persistence and move laterally while minimizing malware use. Secureworks identified the same actor as **BRONZE SILHOUETTE**, linking it to cyberespionage operations against U.S. government and defense organizations. Across observed intrusions, the group conducted reconnaissance, collected and exported Active Directory data including `ntds.dit` and LDAP objects, deployed web shells on edge devices, and compressed stolen information for exfiltration in short bursts designed to evade detection. U.S. defenders warned that the tradecraft appeared intended to support long-term access and potential disruption of critical services during future geopolitical conflict.
Jul 20, 2026
Microsoft and U.S. officials said China-linked threat groups **Volt Typhoon** and **Flax Typhoon** used living-off-the-land techniques and legitimate software to quietly compromise targets while minimizing detection. Volt Typhoon was tied to intrusions affecting U.S. critical infrastructure, with reporting describing the group as breaching networks through stealthy post-compromise activity rather than malware-heavy tradecraft. U.S. agencies later warned that the campaign appeared aimed at **pre-positioning** inside critical infrastructure for potential disruptive or destructive operations. Microsoft separately reported that **Flax Typhoon** targeted organizations in Taiwan for cyber-espionage, relying on valid credentials, remote access tools, and other trusted utilities to maintain persistence and blend into normal network activity. Subsequent reporting and later tracking indicated that Volt Typhoon remained active against U.S. infrastructure, reinforcing concerns that Chinese state-linked operators are sustaining long-term access across strategically important environments while using native tools and legitimate software to evade defenders.
Jun 29, 2026
Reporting highlighted growing concern that **state-affiliated and state-linked actors** are positioning for disruptive attacks against **operational technology (OT)** and critical infrastructure, with activity that may be difficult for operators to detect. A Codific analysis described five common pathways seen in disruptive grid-focused intrusions—often beginning with **human error or exposed perimeter services**, then escalating through **credential theft**, **remote access exploitation** (e.g., VPNs/gateways), **ransomware**, and misuse of **legitimate industrial commands** that can delay operations and complicate detection and recovery; it also warned that attacks on virtualized environments can hinder restoration efforts and that cascading impacts could be severe (e.g., Lloyd’s “Business Blackout” scenario estimating losses up to **$1T**). Recommended mitigations emphasized proven controls such as **phishing-resistant MFA** and **IT/OT segmentation**, rather than novel defenses. Separate commentary and media content also pointed to OT becoming a frontline in geopolitical escalation, including claims of a coordinated campaign tied to Iran-linked hacktivist activity targeting OT devices such as **Unitronics PLCs** used in water and industrial facilities, alongside psychological operations and SMS spoofing. Other items in the set were leadership/career/podcast-style content without specific incident or vulnerability detail and do not materially add to the OT/power-grid threat reporting.
Jun 29, 2026