Loading story…
Microsoft and U.S. government agencies disclosed that the Chinese state-linked threat group Volt Typhoon infiltrated critical infrastructure organizations in the United States and Guam, with activity affecting sectors including communications, manufacturing, utilities, transportation, construction, maritime, government, information technology, and education. The campaign relied on living-off-the-land techniques to blend into normal administrative activity, using valid accounts, built-in command-line tools, and network equipment to maintain persistence and move laterally while minimizing malware use.
Secureworks identified the same actor as BRONZE SILHOUETTE, linking it to cyberespionage operations against U.S. government and defense organizations. Across observed intrusions, the group conducted reconnaissance, collected and exported Active Directory data including ntds.dit and LDAP objects, deployed web shells on edge devices, and compressed stolen information for exfiltration in short bursts designed to evade detection. U.S. defenders warned that the tradecraft appeared intended to support long-term access and potential disruption of critical services during future geopolitical conflict.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
On 2023-06-30, Anvilogic published an analysis of recurring Volt Typhoon behaviors drawn from previously reported intrusions. The article highlighted reconnaissance, Active Directory data export, and archiving for exfiltration as sequence-based detection opportunities.
On 2023-05-24, Secureworks published a report linking BRONZE SILHOUETTE to targeting of U.S. government and defense organizations. The report described the group's cyberespionage activity and victim focus.
On 2023-05-24, Microsoft published research on Volt Typhoon targeting U.S. critical infrastructure with living-off-the-land techniques. The same day, U.S. government agencies released a joint cybersecurity advisory detailing the threat and associated tradecraft.
Secureworks observed intrusions by the Chinese cyberespionage group BRONZE SILHOUETTE over the period from June 2021 to June 2022. The activity targeted U.S. government, defense, and critical infrastructure organizations and used living-off-the-land techniques and web shells.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
anvilogic.com
Open sourcemicrosoft.com
Open sourcesecureworks.com
Open sourcemedia.defense.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft and U.S. officials said China-linked threat groups **Volt Typhoon** and **Flax Typhoon** used living-off-the-land techniques and legitimate software to quietly compromise targets while minimizing detection. Volt Typhoon was tied to intrusions affecting U.S. critical infrastructure, with reporting describing the group as breaching networks through stealthy post-compromise activity rather than malware-heavy tradecraft. U.S. agencies later warned that the campaign appeared aimed at **pre-positioning** inside critical infrastructure for potential disruptive or destructive operations. Microsoft separately reported that **Flax Typhoon** targeted organizations in Taiwan for cyber-espionage, relying on valid credentials, remote access tools, and other trusted utilities to maintain persistence and blend into normal network activity. Subsequent reporting and later tracking indicated that Volt Typhoon remained active against U.S. infrastructure, reinforcing concerns that Chinese state-linked operators are sustaining long-term access across strategically important environments while using native tools and legitimate software to evade defenders.
Jun 29, 2026
Dragos’ annual OT threat report warns that the China-linked **Volt Typhoon** operation (tracked by Dragos as **Voltzite**) continued compromising US critical infrastructure through 2025, including **electric, oil, and gas** organizations, by abusing edge devices such as **cellular gateways and routers** to gain and maintain long-term access. Dragos CEO Robert M. Lee said the activity is oriented toward *pre-positioning* for future disruption rather than intellectual property theft, with intrusions aimed at achieving persistence and, in some cases, getting “inside the control loop” of industrial processes. US authorities and Dragos assess the strategic objective as establishing footholds in operational technology environments to enable **destructive or disruptive attacks** that could impede US response and military mobilization during a crisis. Lee also cautioned that some compromised sites in the US and allied countries may **never be identified**, particularly among smaller or less mature utilities (notably in the **water sector**), even as forthcoming US regulations over the next several years may improve detection and remediation capabilities across parts of the energy sector.
Jun 29, 2026
Salt Typhoon, a threat group linked to the People’s Republic of China, conducted a multiyear cyber espionage campaign targeting major U.S. telecom providers such as Verizon, AT&T, and T-Mobile, compromising the data of hundreds of millions of users. The campaign is considered by U.S. officials to be the most significant cyber espionage operation in history, with attackers gaining access to sensitive information including call logs, unencrypted texts, and audio from high-ranking political figures, as well as targeting law enforcement intercept backdoors and military networks. The group’s activities have raised concerns about potential election interference, political blackmail, and threats to national security. Salt Typhoon exploited unpatched, end-of-life, and forgotten network perimeter devices—such as routers, VPNs, and firewalls—using sophisticated “living off the land” tactics to establish long-term persistence and evade detection. The attackers stole administrator credentials, network traffic diagrams, and personal information from military and state cybersecurity personnel, using this intelligence to fuel further intrusions. The campaign highlights the urgent need for organizations to address technical debt and proactively secure legacy infrastructure, as reactive patching cannot undo compromises on already breached devices.
Jul 12, 2026