Volt Typhoon

Also known as: BRONZE SILHOUETTE, Vanguard Panda, Insidious Taurus

Overview

Chinese state-sponsored actor pre-positioned in US critical infrastructure. Confirmed access to water, energy, transportation, and telecom systems. Uses exclusively living-off-the-land techniques.

MITRE ATT&CK Coverage

Recon
Res Dev
Init Access
Execution
Persistence
Priv Esc
Def Evasion
Cred Access
Discovery
Lat Move
Collection
C2
Exfil
Impact
3 of 14 tactics observed

Raw TTPs

Living-off-the-LandSOHO Router BotnetsVPN ExploitationFirmware PersistenceOT Pivoting

Related Intelligence (2)

CRITICALAptExploited

Volt Typhoon Compromises US Natural Gas Pipeline Operator OT Networks

Volt Typhoon confirmed inside OT networks of a major US natural gas pipeline operator. Access to safety instrumented systems raises explosion risk concerns.

Pipeline SCADA
CISA / TSA Emergency Directive
CRITICALAptExploited

Volt Typhoon in US Water Systems Triggers EPA Emergency Order

EPA emergency order after confirming Volt Typhoon access to water treatment SCADA systems serving 20M+ Americans. Chemical dosing manipulation capability confirmed.

SCADA Systems
EPA / CISA Emergency Advisory