Volt Typhoon

Notable campaigns

1. 2023Microsoft disclosure

   Microsoft reported activity against critical infrastructure in Guam and the US, with access through internet-facing Fortinet devices.

2. 2024KV botnet disruption

   The US DOJ announced a court-authorised operation that removed the group's malware from hundreds of end-of-life US routers.

3. 2024Pre-positioning advisory

   A joint advisory (AA24-038A) reported the group had kept footholds in some victim networks for at least five years.

Signature ATT&CK techniques

• T1190Exploit Public-Facing Application
• T1584.008Compromise Infrastructure: Network Devices
• T1090.003Proxy: Multi-hop Proxy
• T1078Valid Accounts
• T1003.003OS Credential Dumping: NTDS
• T1047Windows Management Instrumentation
• T1059.001Command and Scripting Interpreter: PowerShell

Selected from the group's MITRE ATT&CK entry, plus initial-access techniques named in the cited advisories.

Defences that work against this actor

• Patch edge devices first and replace end-of-life routers, firewalls and VPNs that no longer get fixes.
• Enable command-line and PowerShell logging and baseline normal admin tool use, so living-off-the-land activity stands out.
• Alert on attempts to copy NTDS.dit (ntdsutil, volume shadow copies on domain controllers).
• Keep logs centrally for long enough to investigate multi-year intrusions.
• Segment OT from IT and require MFA for all remote access.

Learn and practise on CyberCertPrep

Sources

• MITRE ATT&CK: Volt Typhoon (G1017)
• CISA AA24-038A: PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure
• Microsoft: Volt Typhoon targets US critical infrastructure with living-off-the-land techniques