Volt Typhoon

Origin🇨🇳 China

Techniques (MITRE ATT&CK)81

SourceMITRE ATT&CK

Also known as:BRONZE SILHOUETTEVanguard PandaDEV-0391UNC3236VoltziteInsidious TaurusDazedToad

Vexday analysis

Volt Typhoon é um agente patrocinado pelo Estado da República Popular da China, ativo pelo menos desde 2021, com atuação voltada principalmente a organizações de infraestrutura crítica nos Estados Unidos e em seus territórios, incluindo Guam. O padrão de comportamento do grupo foi avaliado como pré-posicionamento para movimentação lateral em ativos de tecnologia operacional (OT), visando potenciais ataques destrutivos ou disruptivos. Nas suas operações, o grupo enfatiza a furtividade por meio de web shells, binários living-off-the-land (LOTL), atividades manuais no teclado e uso de credenciais roubadas. O grupo possui 81 técnicas documentadas no MITRE ATT&CK e é associado à exploração de 2 CVEs, sendo também referenciado pelos aliases BRONZE SILHOUETTE, Vanguard Panda, DEV-0391, UNC3236, Voltzite e Insidious Taurus.

Attack chain

Plausible scenario built from the group's real techniques, ordered by the phases of an attack. Each step shows how the group typically operates.

Arsenal severity77

Impact: High

Illustrative chain derived from techniques documented in MITRE ATT&CK — it does not represent a specific past attack. Severity summarizes the known arsenal (kill-chain coverage, actively exploited CVEs, techniques).

Techniques (MITRE ATT&CK) 81

How the group operates, mapped to the MITRE ATT&CK matrix and organized by the phases of an attack.

Reconnaissance

Gather Victim Identity Information Email Addresses Gather Victim Network Information Network Topology Network Security Appliances Gather Victim Org Information Identify Roles Gather Victim Host Information Search Open Websites/Domains Search Victim-Owned Websites Scan Databases

Resource development

Virtual Private Server Server Botnet Network Devices Exploits Tool Vulnerabilities

Initial access

Exploit Public-Facing Application

Execution

Windows Management Instrumentation PowerShell Windows Command Shell Unix Shell

Persistence

External Remote Services Web Shell

Privilege escalation

Exploitation for Privilege Escalation

Credential access

LSASS Memory NTDS Unsecured Credentials Private Keys Credentials from Password Stores Credentials from Web Browsers

Lateral movement

Remote Desktop Protocol Lateral Tool Transfer

Collection

Data from Local System Keylogging Data Staged Local Data Staging Screen Capture Archive via Utility

Command and control

Proxy Internal Proxy Multi-hop Proxy Ingress Tool Transfer Symmetric Cryptography

defense-impairment

Modify Registry Clear Windows Event Logs

stealth

Direct Volume Access Software Packing Match Legitimate Resource Name or Location Masquerade File Type File Deletion Clear Network Connection History and Configurations Valid Accounts Domain Accounts Deobfuscate/Decode Files or Information System Binary Proxy Execution System Checks

Exploited vulnerabilities 2

CVEs this group is known to exploit, per MITRE ATT&CK. Ordered by real-world severity.

CVE-2014-7169CRITICALEPSS 100%KEV CVE-2016-6662EPSS 68%

References

Volt Typhoon uses real techniques and exploits real flaws. TrueHacking's AI Autonomous Pentest simulates these attacks against your infrastructure and brings more security to your application.

Explore the AI Autonomous Pentest →