Skip to content

Volt Typhoon

Volt Typhoon is a People's Republic of China (PRC) state-sponsored actor that has been active since at least 2021, primarily targeting critical infrastructure organizations in the US and its territories including Guam. Volt Typhoon's targeting and pattern of behavior have been assessed as pre-positioning to enable lateral movement to operational technology (OT) assets for potential destructive or disruptive attacks. Volt Typhoon has emphasized stealth in operations using web shells, living-off-the-land (LOTL) binaries, hands on keyboard activities, and stolen credentials.. The group has leveraged compromised…

ATT&CK ID: G1017
Origin: China
Weather family: Typhoon
Techniques: 58
Tools: 17

Also tracked as BRONZE SILHOUETTE · Vanguard Panda · DEV-0391 · UNC3236 · Voltzite · Insidious Taurus · DazedToad

Techniques

Reconnaissance

Gather Victim Identity Information Gather Victim Network Information Gather Victim Org Information Gather Victim Host Information Search Open Websites/Domains Search Victim-Owned Websites Search Open Technical Databases

Resource Development

Compromise Infrastructure Develop Capabilities Obtain Capabilities

Initial Access

Valid Accounts External Remote Services Exploit Public-Facing Application

Execution

Windows Management Instrumentation Command and Scripting Interpreter

Persistence

Valid Accounts Modify Registry External Remote Services Server Software Component

Privilege Escalation

Exploitation for Privilege Escalation Valid Accounts

Stealth

Direct Volume Access Obfuscated Files or Information Masquerading Indicator Removal Valid Accounts Deobfuscate/Decode Files or Information System Binary Proxy Execution Virtualization/Sandbox Evasion

Defense Impairment

Modify Registry Disable or Modify Tools

Credential Access

OS Credential Dumping Input Capture Unsecured Credentials Credentials from Password Stores

Discovery

System Service Discovery Application Window Discovery Query Registry System Network Configuration Discovery Remote System Discovery System Owner/User Discovery Network Service Discovery System Network Connections Discovery Process Discovery Permission Groups Discovery File and Directory Discovery Account Discovery Peripheral Device Discovery System Time Discovery Browser Information Discovery Virtualization/Sandbox Evasion Software Discovery System Location Discovery Log Enumeration Local Storage Discovery

Lateral Movement

Remote Services Lateral Tool Transfer

Collection

Data from Local System Input Capture Data Staged Screen Capture Archive Collected Data

Command and Control

Proxy Ingress Tool Transfer Encrypted Channel

Software

FRP · Impacket · Mimikatz · Net · Nltest · Ping · PsExec · Reg · Systeminfo · Tasklist · VersaMem · Wevtutil · certutil · cmd · ipconfig · netsh · netstat

MITRE ATT&CK All threat actors