Volt Typhoon

Origin🇨🇳 China

Techniques (MITRE ATT&CK)81

SourceMITRE ATT&CK

Also known as:BRONZE SILHOUETTEDEV-0391DazedToadDev-0391Insidious TaurusStorm-0391UNC3236VANGUARD PANDAVOLTZITEVanguard PandaVoltzite

About the group

Volt Typhoon is a People's Republic of China (PRC) state-sponsored actor that has been active since at least 2021, primarily targeting critical infrastructure organizations in the US and its territories including Guam. Volt Typhoon's targeting and pattern of behavior have been assessed as pre-positioning to enable lateral movement to operational technology (OT) assets for potential destructive or disruptive attacks. Volt Typhoon has emphasized stealth in operations using web shells, living-off-the-land (LOTL) binaries, hands on keyboard activities, and stolen credentials.. The group has leveraged compromised SOHO routers to proxy command and control traffic and obscure its infrastructure, activity associated with the KV botnet.. Reporting indicates a separate initial access cluster, SYLVANITE, has been observed exploiting internet-facing edge devices and transferring access to Volt Typhoon, also tracked as VOLTZITE, for follow-on operations.

Attack chain

Plausible scenario built from the group's real techniques, ordered by the phases of an attack. Each step shows how the group typically operates.

Arsenal severity77

Impact: High

Illustrative chain derived from techniques documented in MITRE ATT&CK — it does not represent a specific past attack. Severity summarizes the known arsenal (kill-chain coverage, actively exploited CVEs, techniques).

Techniques (MITRE ATT&CK) 81

How the group operates, mapped to the MITRE ATT&CK matrix and organized by the phases of an attack.

Reconnaissance

Gather Victim Identity Information Email Addresses Gather Victim Network Information Network Topology Network Security Appliances Gather Victim Org Information Identify Roles Gather Victim Host Information Search Open Websites/Domains Search Victim-Owned Websites Scan Databases

Resource development

Virtual Private Server Server Botnet Network Devices Exploits Tool Vulnerabilities

Initial access

Exploit Public-Facing Application

Execution

Windows Management Instrumentation PowerShell Windows Command Shell Unix Shell

Persistence

External Remote Services Web Shell

Privilege escalation

Exploitation for Privilege Escalation

Credential access

LSASS Memory NTDS Unsecured Credentials Private Keys Credentials from Password Stores Credentials from Web Browsers

Lateral movement

Remote Desktop Protocol Lateral Tool Transfer

Collection

Data from Local System Keylogging Data Staged Local Data Staging Screen Capture Archive via Utility

Command and control

Proxy Internal Proxy Multi-hop Proxy Ingress Tool Transfer Symmetric Cryptography

defense-impairment

Modify Registry Clear Windows Event Logs

stealth

Direct Volume Access Software Packing Match Legitimate Resource Name or Location Masquerade File Type File Deletion Clear Network Connection History and Configurations Valid Accounts Domain Accounts Deobfuscate/Decode Files or Information System Binary Proxy Execution System Checks

Exploited vulnerabilities 2

CVEs this group is known to exploit, per MITRE ATT&CK. Ordered by real-world severity.

CVE-2014-7169CRITICALEPSS 100%KEV MITRE ATT&CK

CVE-2016-6662EPSS 68% MITRE ATT&CK

References

Volt Typhoon uses real techniques and exploits real flaws. TrueHacking's AI Autonomous Pentest simulates these attacks against your infrastructure and brings more security to your application.

Explore the AI Autonomous Pentest →