Volt Typhoon Breached US Critical Infrastructure Using Living-off-the-Land Tactics

Microsoft and U.S. government agencies disclosed that the Chinese state-linked threat group Volt Typhoon infiltrated critical infrastructure organizations in the United States and Guam, with activity affecting sectors including communications, manufacturing, utilities, transportation, construction, maritime, government, information technology, and education. The campaign relied on living-off-the-land techniques to blend into normal administrative activity, using valid accounts, built-in command-line tools, and network equipment to maintain persistence and move laterally while minimizing malware use.

Secureworks identified the same actor as BRONZE SILHOUETTE, linking it to cyberespionage operations against U.S. government and defense organizations. Across observed intrusions, the group conducted reconnaissance, collected and exported Active Directory data including ntds.dit and LDAP objects, deployed web shells on edge devices, and compressed stolen information for exfiltration in short bursts designed to evade detection. U.S. defenders warned that the tradecraft appeared intended to support long-term access and potential disruption of critical services during future geopolitical conflict.