Volt Typhoon

Also known as: BRONZE SILHOUETTE, DazedToad, DEV-0391, Dev-0391, Insidious Taurus, Storm-0391, UNC3236, Vanguard Panda, VANGUARD PANDA, Volt Typhoon, Voltzite, VOLTZITE

Volt Typhoon is a People’s Republic of China (PRC) state-sponsored actor that has been active since at least 2021 primarily targeting critical infrastructure organizations in the US and its territories including Guam. Volt Typhoon’s targeting and pattern of behavior have been assessed as pre-positioning to enable lateral movement to operational technology (OT) assets for potential destructive or disruptive attacks. Volt Typhoon has emphasized stealth in operations using web shells, living-off-the-land (LOTL) binaries, hands on keyboard activities, and stolen credentials. CISA AA24-038A PRC Critical Infrastructure February 2024 Microsoft Volt Typhoon May 2023 Joint Cybersecurity Advisory Volt Typhoon June 2023 Secureworks BRONZE SILHOUETTE May 2023

🌍 Country China
🧭 ATT&CK G1017

Introduction

Volt Typhoon is a People’s Republic of China (PRC) state-sponsored actor that has been active since at least 2021 primarily targeting critical infrastructure organizations in the US and its territories including Guam. Volt Typhoon’s targeting and pattern of behavior have been assessed as pre-positioning to enable lateral movement to operational technology (OT) assets for potential destructive or disruptive attacks. Volt Typhoon has emphasized stealth in operations using web shells, living-off-the-land (LOTL) binaries, hands on keyboard activities, and stolen credentials. CISA AA24-038A PRC Critical Infrastructure February 2024 Microsoft Volt Typhoon May 2023 Joint Cybersecurity Advisory Volt Typhoon June 2023 Secureworks BRONZE SILHOUETTE May 2023

Activities and Tactics

Country of Origin: 🇨🇳 China

Notable Campaigns

  • Versa Director Zero Day Exploitation (C0039): Versa Director Zero Day Exploitation was conducted by Volt Typhoon from early June through August 2024 as zero-day exploitation of Versa Director servers controlling software-defined wide area network (SD-WAN) applications. Since tracked as CVE-2024-39717, exploitation focused on credential capture from compromised Versa Director servers at managed service providers (MSPs) and internet service providers (ISPs) to enable follow-on access to service provider clients. Versa Director Zero Day Exploit
  • KV Botnet Activity (C0035): KV Botnet Activity consisted of exploitation of primarily “end-of-life” small office-home office (SOHO) equipment from manufacturers such as Cisco, NETGEAR, and DrayTek. KV Botnet Activity was used by Volt Typhoon to obfuscate connectivity to victims in multiple critical infrastructure segments, including energy and telecommunication companies and entities based on the US territory of Guam. While the KV Botnet is the most prominent element of this campaign, it overlaps with another botnet cluster

Tactics, Techniques, and Procedures (TTPs)

ATT&CK technique IDs (denormalized)

Notable Indicators of Compromise (IOCs)

No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.

Malware and Tools

  • China Chopper
  • UNITEDRAKE
  • Mimikatz:
  • ProcDump:
  • Nbtscan:
  • SparrowDoor:
  • KV-Botnet:
  • KV:
  • JDY:

MITRE ATT&CK Software

Attribution and Evidence

Country of Origin: China Additional attribution information pending cataloguing.

References

[1] mitre-attack [2] Cloudflare 2026 Threat Report New Threat Actors March 2026 Cloudflare. (2026, March 3). Introducing the 2026 Cloudflare Threat Report. Retrieved April 18, 2026. [10] CISA AA24-038A PRC Critical Infrastructure February 2024 CISA et al.. (2024, February 7). PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure. Retrieved May 15, 2024. [11] Secureworks BRONZE SILHOUETTE May 2023 Counter Threat Unit Research Team. (2023, May 24). Chinese Cyberespionage Group BRONZE SILHOUETTE Targets U.S. Government and Defense Organizations. Retrieved July 27, 2023. [12] Dragos 2025 Year in Review Dragos. (2026, February). 9TH ANNUAL YEAR IN REVIEW | OT/ICS CYBERSECURITY REPORT . Retrieved April 26, 2026. [13] Microsoft Volt Typhoon May 2023 Microsoft Threat Intelligence. (2023, May 24). Volt Typhoon targets US critical infrastructure with living-off-the-land techniques. Retrieved July 27, 2023. [14] Joint Cybersecurity Advisory Volt Typhoon June 2023 NSA et al. (2023, May 24). People’s Republic of China State-Sponsored Cyber Actor Living off the Land to Evade Detection. Retrieved July 27, 2023. [15] DOJ KVBotnet 2024 US Department of Justice. (2024, January 31). U.S. Government Disrupts Botnet People’s Republic of China Used to Conceal Hacking of Critical Infrastructure. Retrieved June 10, 2024.