China-Linked Volt Typhoon and Flax Typhoon Use Stealthy Access in Critical Sectors

Microsoft and U.S. officials said China-linked threat groups Volt Typhoon and Flax Typhoon used living-off-the-land techniques and legitimate software to quietly compromise targets while minimizing detection. Volt Typhoon was tied to intrusions affecting U.S. critical infrastructure, with reporting describing the group as breaching networks through stealthy post-compromise activity rather than malware-heavy tradecraft. U.S. agencies later warned that the campaign appeared aimed at pre-positioning inside critical infrastructure for potential disruptive or destructive operations.

Microsoft separately reported that Flax Typhoon targeted organizations in Taiwan for cyber-espionage, relying on valid credentials, remote access tools, and other trusted utilities to maintain persistence and blend into normal network activity. Subsequent reporting and later tracking indicated that Volt Typhoon remained active against U.S. infrastructure, reinforcing concerns that Chinese state-linked operators are sustaining long-term access across strategically important environments while using native tools and legitimate software to evade defenders.