volt-typhoon

• SKILL.mdcore · 18,881 bytes
• SKILL.mdcore · 18,881 bytes

# Volt Typhoon (BRONZE SILHOUETTE, Vanguard Panda, Insidious Taurus) — Adversary Emulation Profile

Volt Typhoon is a People's Republic of China (PRC) state-sponsored cyber actor active since at least mid-2021, tracked by MITRE ATT&CK as **G1017** and known by the aliases BRONZE SILHOUETTE (Secureworks), Vanguard Panda (CrowdStrike), Voltzite (Dragos), Insidious Taurus (Palo Alto Unit 42), DEV-0391 (Microsoft's pre-naming designation), and UNC3236 (Mandiant). Unlike financially motivated crews, Volt Typhoon's hallmark is patient, ultra-stealthy **pre-positioning** inside US critical infrastructure — communications, energy, water, and transportation — using almost exclusively **living-off-the-land (LOTL)** techniques and legitimate stolen credentials, with little or no custom malware on victim hosts. CISA, the NSA, and the FBI assess the group is establishing persistent access not for immediate espionage value but to enable lateral movement to operational technology (OT) for potential disruptive or destructive attacks during a future geopolitical crisis or conflict. Its operational signature is hands-on-keyboard activity, native OS binaries, web shells on edge appliances, and traffic proxied through compromised small-office/home-office (SOHO) routers to blend into normal network noise.

## Attribution & motivation

- **Sponsor / nation:** People's Republic of China (PRC), state-sponsored. CISA/NSA/FBI and Microsoft attribute the activity to a PRC nexus; Microsoft assessed the actor as PRC state-sponsored with high confidence.
- **Motivation:** Strategic pre-positioning / preparation of the environment rather than classic data-theft espionage. Microsoft assessed *with moderate confidence* that the campaign pursues capabilities that could **disrupt critical communications infrastructure between the US and the Asia region during a future crisis**. CISA's AA24-038A frames the intent as enabling **destructive or disruptive cyberattacks against OT** in the event of conflict. This is closer to destructive/wartime-enabling than financial or influence motivation.
- **Confidence:** Attribution to a PRC state-sponsored actor is high (joint government + multiple vendor concurrence). The disruptive-intent assessment is moderate confidence per the original reporting.

## Targeting

- **Sectors:** US critical infrastructure — communications, energy/utility (electric, water/wastewater), transportation systems, maritime, manufacturing, construction, government, information technology, and education.
- **Regions:** Continental United States and **US territories, notably Guam** (a strategic Indo-Pacific military hub). Activity also observed against partners in the Five Eyes. The August 2024 Versa Director campaign hit US-based ISPs, MSPs, and IT-sector organizations and at least one non-US victim.