Volt Typhoon

APT / StateG1017 ↗
OriginChina
Techniques (MITRE ATT&CK)81
SourceMITRE ATT&CK
Also known as:BRONZE SILHOUETTEVanguard PandaDEV-0391UNC3236VoltziteInsidious TaurusDazedToad

Vexday analysis

Volt Typhoon é um agente patrocinado pelo Estado da República Popular da China, ativo pelo menos desde 2021, com atuação voltada principalmente a organizações de infraestrutura crítica nos Estados Unidos e em seus territórios, incluindo Guam. O padrão de comportamento do grupo foi avaliado como pré-posicionamento para movimentação lateral em ativos de tecnologia operacional (OT), visando potenciais ataques destrutivos ou disruptivos. Nas suas operações, o grupo enfatiza a furtividade por meio de web shells, binários living-off-the-land (LOTL), atividades manuais no teclado e uso de credenciais roubadas. O grupo possui 81 técnicas documentadas no MITRE ATT&CK e é associado à exploração de 2 CVEs, sendo também referenciado pelos aliases BRONZE SILHOUETTE, Vanguard Panda, DEV-0391, UNC3236, Voltzite e Insidious Taurus.

Techniques (MITRE ATT&CK) 81

How the group operates, mapped to the MITRE ATT&CK matrix and organized by the phases of an attack.

Reconnaissance
Gather Victim Identity InformationEmail AddressesGather Victim Network InformationNetwork TopologyNetwork Security AppliancesGather Victim Org InformationIdentify RolesGather Victim Host InformationSearch Open Websites/DomainsSearch Victim-Owned WebsitesScan Databases
Resource development
Virtual Private ServerServerBotnetNetwork DevicesExploitsToolVulnerabilities
Initial access
Exploit Public-Facing Application
Execution
Windows Management InstrumentationPowerShellWindows Command ShellUnix Shell
Persistence
External Remote ServicesWeb Shell
Privilege escalation
Exploitation for Privilege Escalation
Credential access
LSASS MemoryNTDSUnsecured CredentialsPrivate KeysCredentials from Password StoresCredentials from Web Browsers
Discovery
System Service DiscoveryApplication Window DiscoveryQuery RegistrySystem Network Configuration DiscoveryInternet Connection DiscoveryRemote System DiscoverySystem Owner/User DiscoveryNetwork Service DiscoverySystem Network Connections DiscoveryProcess DiscoveryPermission Groups DiscoveryLocal GroupsDomain GroupsFile and Directory DiscoveryLocal AccountDomain AccountPeripheral Device DiscoverySystem Time DiscoveryBrowser Information DiscoverySoftware DiscoverySystem Location DiscoveryLog EnumerationLocal Storage Discovery
Lateral movement
Remote Desktop ProtocolLateral Tool Transfer
Collection
Data from Local SystemKeyloggingData StagedLocal Data StagingScreen CaptureArchive via Utility
Command and control
ProxyInternal ProxyMulti-hop ProxyIngress Tool TransferSymmetric Cryptography
defense-impairment
Modify RegistryClear Windows Event Logs
stealth
Direct Volume AccessSoftware PackingMatch Legitimate Resource Name or LocationMasquerade File TypeFile DeletionClear Network Connection History and ConfigurationsValid AccountsDomain AccountsDeobfuscate/Decode Files or InformationSystem Binary Proxy ExecutionSystem Checks

Exploited vulnerabilities 2

CVEs this group is known to exploit, per MITRE ATT&CK. Ordered by real-world severity.

CVE-2014-7169CRITICALEPSS 100%KEVCVE-2016-6662EPSS 68%

Volt Typhoon uses real techniques and exploits real flaws. TrueHacking's AI Autonomous Pentest simulates these attacks against your infrastructure and brings more security to your application.

Explore the AI Autonomous Pentest →