Loading story…
SentinelLABS reported that China’s Computer Virus Emergency Response Center (CVERC) published another report alleging that the U.S. government, rather than China, was responsible for Volt Typhoon activity, but the analysis found the document offered no new evidence. The report was presented as part of a broader messaging effort that sought to recast a widely tracked cyber-espionage campaign and shift blame away from Beijing.
According to SentinelLABS, the publication fits a recurring state-directed influence pattern in which Chinese cybersecurity firms, CVERC, state media, and official channels amplify accusations of U.S. hacking using older leaked intelligence material. The campaign was assessed as aiming to weaken support for U.S. Section 702 surveillance authorities, bolster efforts to remove foreign technology such as Microsoft from Chinese government systems, and divert attention from recent Chinese espionage incidents in Europe; its release in multiple languages, including Japanese, French, and German, also indicated an effort to shape opinion beyond China.
TTPs, infrastructure, and targeting history in one profile.
1 event from the most recent confirmed update back to the earliest known activity.
China's Computer Virus Emergency Response Center issued a third report claiming the U.S. government, rather than China, was behind Volt Typhoon activity. SentinelLABS assessed that the report provided no new evidence and fit a broader Beijing influence narrative.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft and U.S. officials said China-linked threat groups **Volt Typhoon** and **Flax Typhoon** used living-off-the-land techniques and legitimate software to quietly compromise targets while minimizing detection. Volt Typhoon was tied to intrusions affecting U.S. critical infrastructure, with reporting describing the group as breaching networks through stealthy post-compromise activity rather than malware-heavy tradecraft. U.S. agencies later warned that the campaign appeared aimed at **pre-positioning** inside critical infrastructure for potential disruptive or destructive operations. Microsoft separately reported that **Flax Typhoon** targeted organizations in Taiwan for cyber-espionage, relying on valid credentials, remote access tools, and other trusted utilities to maintain persistence and blend into normal network activity. Subsequent reporting and later tracking indicated that Volt Typhoon remained active against U.S. infrastructure, reinforcing concerns that Chinese state-linked operators are sustaining long-term access across strategically important environments while using native tools and legitimate software to evade defenders.
Jun 29, 2026
SecurityScorecard reported that the China-linked espionage group **Volt Typhoon** appears to have built a botnet from end-of-life Cisco `RV320` and `RV325` routers and other SOHO edge devices, with roughly 30% of 1,116 observed devices communicating with known command-and-control infrastructure over a 37-day period. The activity is tied to exploitation of older Cisco flaws including `CVE-2019-1652` and `CVE-2019-1653`, and researchers identified a previously unspecified payload or webshell, `fy.sh`, linked to a Volt Typhoon payload server at `45.11.92[.]176`. Additional suspected infrastructure, including `45.63.60[.]39` and `45.32.174[.]131`, was associated with the group's **JDY** cluster through shared SSL certificate traits. The findings add technical detail to broader U.S. warnings that Volt Typhoon has implanted malware in critical infrastructure networks, including utilities supporting military bases, in what officials and reporting have described as preparation for potential disruption during a Taiwan-related crisis. Separate analysis by DCSO challenged one part of the public reporting, saying evidence does not show that `67.205.139[.]175` functioned as a Tor exit relay when it communicated with `45.63.60[.]39`, leaving open other explanations such as use of a Tor hidden service or a relay for operational cover. Even with that dispute, the reporting collectively points to a stealthy China-backed campaign using compromised edge devices and covert infrastructure to support long-term access near sensitive U.S. government and military-adjacent networks.
Aug 15, 2026
China-linked hacking groups were reported to have penetrated a wide range of targets across the United States and allied regions, including manufacturers, U.S. government email systems, internet providers, and major telecommunications networks. Earlier reporting described broad economic espionage aimed at stealing trade secrets from manufacturing sectors in the U.S., Europe, and Asia, while later disclosures said Chinese operators breached U.S. government email accounts through Microsoft cloud infrastructure and infiltrated American internet providers for surveillance. Subsequent investigations tied the telecom intrusions to the **Salt Typhoon** campaign, which officials said exposed sensitive metadata and provided insight into U.S. surveillance targets. U.S. officials characterized the activity, alongside related operations such as **Volt Typhoon**, as one of the most serious cyber threats to American critical infrastructure in recent years. Reporting said investigators believed the attackers may have retained access to at least eight telecom firms, including **Verizon** and **AT&T**, and that the campaign extended to dozens of telecoms and government agencies. In response, the Biden administration moved to bar the remaining U.S. operations of **China Telecom Americas**, citing national security risks and signaling the first public retaliatory step tied to the telecom compromises, even as debate continued over broader sanctions, technology restrictions, and offensive cyber responses.
Jun 29, 2026