H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Group

Volt Typhoon

[Volt Typhoon](https://attack.mitre.org/groups/G1017) is a People's Republic of China (PRC) state-sponsored actor that has been active since at least 2021, primarily targeting critical infrastructure organizations in the US and its territories including Guam. [Volt Typhoon](https://attack.mitre.org/groups/G1017)'s targeting and pattern of behavior have been assessed as pre-positioning to enable lateral movement to operational technology (OT) assets for potential destructive or disruptive attacks. [Volt Typhoon](https://attack.mitre.org/groups/G1017) has emphasized stealth in operations using web shells, living-off-the-land (LOTL) binaries, hands on keyboard activities, and stolen credentials.(Citation: CISA AA24-038A PRC Critical Infrastructure February 2024)(Citation: Microsoft Volt Typhoon May 2023)(Citation: Joint Cybersecurity Advisory Volt Typhoon June 2023)(Citation: Secureworks BRONZE SILHOUETTE May 2023). The group has leveraged compromised SOHO routers to proxy command and control traffic and obscure its infrastructure, activity associated with the KV botnet.(Citation: DOJ KVBotnet 2024). Reporting indicates a separate initial access cluster, SYLVANITE, has been observed exploiting internet-facing edge devices and transferring access to [Volt Typhoon](https://attack.mitre.org/groups/G1017), also tracked as VOLTZITE, for follow-on operations. (Citation: Dragos 2025 Year in Review)

Group
TypeGroup
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[Volt Typhoon](https://attack.mitre.org/groups/G1017) is a People's Republic of China (PRC) state-sponsored actor that has been active since at least 2021, primarily targeting critical infrastructure organizations in the US and its territories including Guam. [Volt Typhoon](https://attack.mitre.org/groups/G1017)'s targeting and pattern of behavior have been assessed as pre-positioning to enable lateral movement to operational technology (OT) assets for potential destructive or disruptive attacks. [Volt Typhoon](https://attack.mitre.org/groups/G1017) has emphasized stealth in operations using web shells, living-off-the-land (LOTL) binaries, hands on keyboard activities, and stolen credentials.(Citation: CISA AA24-038A PRC Critical Infrastructure February 2024)(Citation: Microsoft Volt Typhoon May 2023)(Citation: Joint Cybersecurity Advisory Volt Typhoon June 2023)(Citation: Secureworks BRONZE SILHOUETTE May 2023). The group has leveraged compromised SOHO routers to proxy command and control traffic and obscure its infrastructure, activity associated with the KV botnet.(Citation: DOJ KVBotnet 2024). Reporting indicates a separate initial access cluster, SYLVANITE, has been observed exploiting internet-facing edge devices and transferring access to [Volt Typhoon](https://attack.mitre.org/groups/G1017), also tracked as VOLTZITE, for follow-on operations. (Citation: Dragos 2025 Year in Review)

100 recorded

Relationships

attributed-to
from KV Botnet Activity
Campaign
attributed-to
from Versa Director Zero Day Exploitation
Campaign
uses
to Application Window Discovery
Technique
uses
to Archive via Utility
Technique
uses
to Botnet
Technique
uses
to Browser Information Discovery
Technique
uses
to certutil
Tool
uses
to Clear Network Connection History and Configurations
Technique
uses
to Clear Windows Event Logs
Technique
uses
to cmd
Tool
uses
to Credentials from Password Stores
Technique
uses
to Credentials from Web Browsers
Technique
uses
to Data from Local System
Technique
uses
to Data Staged
Technique
uses
to Deobfuscate/Decode Files or Information
Technique
uses
to Direct Volume Access
Technique
uses
to Domain Account
Technique
uses
to Domain Accounts
Technique
uses
to Domain Groups
Technique
uses
to Email Addresses
Technique
uses
to Exploitation for Privilege Escalation
Technique
uses
to Exploit Public-Facing Application
Technique
uses
to Exploits
Technique
uses
to External Remote Services
Technique
uses
to File and Directory Discovery
Technique
uses
to File Deletion
Technique
uses
to FRP
Tool
uses
to Gather Victim Host Information
Technique
uses
to Gather Victim Identity Information
Technique
uses
to Gather Victim Network Information
Technique
uses
to Gather Victim Org Information
Technique
uses
to Identify Roles
Technique
uses
to Impacket
Tool
uses
to Ingress Tool Transfer
Technique
uses
to Internal Proxy
Technique
uses
to Internet Connection Discovery
Technique
uses
to ipconfig
Tool
uses
to Keylogging
Technique
uses
to Lateral Tool Transfer
Technique
uses
to Local Account
Technique
uses
to Local Data Staging
Technique
uses
to Local Groups
Technique
uses
to Local Storage Discovery
Technique
uses
to Log Enumeration
Technique
uses
to LSASS Memory
Technique
uses
to Masquerade File Type
Technique
uses
to Match Legitimate Resource Name or Location
Technique
uses
to Mimikatz
Tool
uses
to Modify Registry
Technique
uses
to Multi-hop Proxy
Technique
uses
to Net
Tool
uses
to netsh
Tool
uses
to netstat
Tool
uses
to Network Devices
Technique
uses
to Network Security Appliances
Technique
uses
to Network Service Discovery
Technique
uses
to Network Topology
Technique
uses
to Nltest
Tool
uses
to NTDS
Technique
uses
to Peripheral Device Discovery
Technique
uses
to Permission Groups Discovery
Technique
uses
to Ping
Tool
uses
to PowerShell
Technique
uses
to Private Keys
Technique
uses
to Process Discovery
Technique
uses
to Proxy
Technique
uses
to PsExec
Tool
uses
to Query Registry
Technique
uses
to Reg
Tool
uses
to Remote Desktop Protocol
Technique
uses
to Remote System Discovery
Technique
uses
to Scan Databases
Technique
uses
to Screen Capture
Technique
uses
to Search Open Websites/Domains
Technique
uses
to Search Victim-Owned Websites
Technique
uses
to Server
Technique
uses
to Software Discovery
Technique
uses
to Software Packing
Technique
uses
to Symmetric Cryptography
Technique
uses
to System Binary Proxy Execution
Technique
uses
to System Checks
Technique
uses
to Systeminfo
Tool
uses
to System Location Discovery
Technique
uses
to System Network Configuration Discovery
Technique
uses
to System Network Connections Discovery
Technique
uses
to System Owner/User Discovery
Technique
uses
to System Service Discovery
Technique
uses
to System Time Discovery
Technique
uses
to Tasklist
Tool
uses
to Tool
Technique
uses
to Unix Shell
Technique
uses
to Unsecured Credentials
Technique
uses
to Valid Accounts
Technique
uses
to VersaMem
Malware
uses
to Virtual Private Server
Technique
uses
to Vulnerabilities
Technique
uses
to Web Shell
Technique
uses
to Wevtutil
Tool
uses
to Windows Command Shell
Technique
uses
to Windows Management Instrumentation
Technique
15 external

References

mitre-attack
G1017
open
Cloudflare 2026 Threat Report New Threat Actors March 2026
https://blog.cloudflare.com/2026-threat-report/
open
Vanguard Panda
—
DEV-0391
—
UNC3236
—
Voltzite
—
Insidious Taurus
—
DazedToad
—
BRONZE SILHOUETTE
—
CISA AA24-038A PRC Critical Infrastructure February 2024
https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf
open
Secureworks BRONZE SILHOUETTE May 2023
https://web.archive.org/web/20230601025540/https://www.secureworks.com/blog/chinese-cyberespionage-group-bronze-silhouette-targets-us-government-and-defense-organizations
open
Dragos 2025 Year in Review
https://5943619.hs-sites.com/hubfs/312-Year-in-Review/2026/Dragos-2026-OT-Cybersecurity-Report-A-Year-in-Review.pdf?hsCtaAttrib=205683189348
open
Microsoft Volt Typhoon May 2023
https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/
open
Joint Cybersecurity Advisory Volt Typhoon June 2023
https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF
open
DOJ KVBotnet 2024
https://www.justice.gov/opa/pr/us-government-disrupts-botnet-peoples-republic-china-used-conceal-hacking-critical
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance