Volt Typhoon Threat Actor Profile

Volt Typhoon is a Chinese state-sponsored group that hides inside critical infrastructure networks using stolen credentials and built-in tools, not to steal data but to be ready to disrupt operations in a future crisis. US and allied agencies assess with high confidence that it is pre-positioning in IT networks to reach operational technology, and some victims had it inside for at least five years. This profile is for defenders in energy, water, communications, transport and the providers that serve them. It covers the group's names, targets, ATT&CK techniques, its heavy reliance on domain credentials, notable incidents to 2026, and how to detect and evict it. It complements the Threat Actor Groups Guide and the Living off the Land Guide.

Key takeaways

Pre-positioning, not espionage. CISA, NSA, FBI and Five Eyes partners assess with high confidence that Volt Typhoon is positioning to disrupt OT functions during a crisis or conflict, and it generally avoids exfiltrating data.
Edge appliances are the front door. Fortinet, Ivanti Connect Secure, NETGEAR, Citrix, Cisco and Versa Director have all been exploited, often followed by ordinary-looking VPN sessions.
Credentials do the work, not malware. Repeated theft of NTDS.dit and LSASS memory gives the group domain-wide valid accounts that blend in with administrators.
Traffic hides behind compromised home and small office routers. The KV botnet of mostly end-of-life Cisco and NETGEAR routers was disrupted in December 2023, but the technique remains.
Assume full domain compromise when you find it. The joint advisory says suspected NTDS.dit theft should be treated as compromise of every domain credential.

Who they are (names and aliases)

MITRE ATT&CK tracks the group as Volt Typhoon (G1017), a People's Republic of China (PRC) state-sponsored actor active since at least 2021 and mainly targeting critical infrastructure in the United States and its territories, including Guam. Microsoft first named it publicly on 24 May 2023, saying it had been active since mid-2021. The February 2024 joint advisory AA24-038A was authored by CISA, NSA and FBI with DOE, EPA, TSA, Australia's ASD's ACSC, Canada's Cyber Centre, the UK NCSC and NCSC-NZ.

Name	Used by	Notes
Volt Typhoon (earlier DEV-0391)	Microsoft, US and allied governments	Most widely used name
BRONZE SILHOUETTE	Secureworks	Also cited by Lumen Black Lotus Labs
Vanguard Panda	CrowdStrike	Listed in ATT&CK
VOLTZITE	Dragos	Dragos describes technical overlaps with Volt Typhoon, not identity
UNC3236, Insidious Taurus, DazedToad	Other security vendors	Listed as associated names in ATT&CK

Dragos also tracks SYLVANITE, an initial access cluster that exploits edge devices and hands footholds to VOLTZITE. Expect access and follow-on activity to come from different operators.

Targeting and motivation

Sectors: AA24-038A confirms compromises in Communications, Energy, Transportation Systems, and Water and Wastewater Systems. Microsoft's 2023 report also lists manufacturing, utility, construction, maritime, government, IT and education.
Geography: the continental US, non-continental US territories and Guam. Microsoft assessed with moderate confidence that the aim was the ability to disrupt communications between the US and Asia during future crises.
Service providers: Lumen attributed exploitation of Versa Director, software used by ISPs and MSPs, to Volt Typhoon with moderate confidence in August 2024, which gives access to downstream customers.
Small utilities: Dragos's case study of Littleton Electric Light and Water Departments in Massachusetts showed a small public utility can be a target.
Motivation: the agencies describe it as preparation for disruptive or destructive effects, not typical espionage. The Wall Street Journal reported in April 2025 that Chinese officials made remarks at a December meeting in Geneva which US officials took as tacit acknowledgement linked to US support for Taiwan; the officials did not directly claim responsibility.

Tactics and techniques (MITRE ATT&CK)

All techniques below are mapped to Volt Typhoon (G1017) in ATT&CK v20 and confirmed in government or vendor reporting.

Tactic	Technique	How it shows up
Resource development	T1584.005 Botnet, T1584.008 Network Devices	KV botnet of compromised SOHO routers used as proxies
Initial access	T1190 Exploit Public-Facing Application	Known and zero-day flaws in network appliances; Versa Director CVE-2024-39717
Initial access, persistence	T1133 External Remote Services, T1078.002 Domain Accounts	VPN sessions with stolen domain credentials
Persistence	T1505.003 Web Shell	VersaMem web shell capturing plaintext credentials
Credential access	T1003.003 NTDS, T1006 Direct Volume Access	Volume Shadow Copy plus ntdsutil to copy NTDS.dit and the SYSTEM hive
Credential access	T1003.001 LSASS Memory	comsvcs.dll MiniDump on a domain controller
Credential access	T1555.003 Credentials from Web Browsers, T1552.004 Private Keys	Browser data, PuTTY sessions and keys, credentials stored on appliances
Execution	T1059.001 PowerShell, T1047 Windows Management Instrumentation	Hands-on-keyboard discovery with built-in tools
Discovery	T1654 Log Enumeration, T1046 Network Service Discovery	PowerShell queries of logon events (4624) to learn user habits
Lateral movement	T1021.001 Remote Desktop Protocol	RDP with valid accounts, including towards OT-adjacent systems
Command and control	T1090.003 Multi-hop Proxy	Chains of compromised routers and FRP proxies
Defence impairment, stealth	T1685.005 Clear Windows Event Logs, T1070.007 Clear Network Connection History and Configurations	Selective log clearing after activity

Defensively, the hard part is that nearly every step uses a legitimate binary (ntdsutil, vssadmin, netsh, wevtutil, certutil, PowerShell) and a legitimate account. Detection depends on baselining who normally does what, not on signatures.

How they abuse identities and credentials

Volt Typhoon is, in practice, an identity intrusion. The joint advisory describes the group repeatedly extracting the Active Directory database over months or years, cracking hashes offline and logging in as real users.

Appliance service accounts: Microsoft observed the group extracting credentials for an Active Directory account used by a Fortinet device and reusing them on other systems. Every edge appliance bound to AD is a non-human identity with domain reach. See the Service Account Security Guide.
Credentials stored on edge devices: AA24-038A tells organisations not to store credentials on edge devices because the group harvests them.
Repeated NTDS.dit theft: watch for ESENT Application log events 216, 325, 326, 327 and 637, which can indicate a copy of the database being created or mounted. See the Credential Dumping Guide.
Credentials captured in transit: the VersaMem web shell hooked authentication to capture plaintext passwords that could then be used against downstream customers.
OT access with IT or default credentials: the advisory says the actors tested default OT vendor credentials and sometimes used credentials from NTDS.dit to reach OT systems such as HVAC, energy and water controls.
Studying logon behaviour: querying Event ID 4624 lets the group pick accounts and times that look normal.

The identity controls that matter most are tiering domain administration, removing AD-bound service accounts from internet-facing appliances where possible, protecting LSASS with LSA protection and Credential Guard (both recommended by Microsoft), and separate credentials for OT. See the Tiered Administration and Enterprise Access Model Guide.

Notable incidents

Date	Event	What happened	Source
Feb to Nov 2023	Littleton Electric Light and Water	More than 300 days of access; OT operating procedures and spatial layout data targeted; published March 2025	Dragos via SecurityWeek
24 May 2023	First public naming	Microsoft reports targeting of Guam and US critical infrastructure	Microsoft
Dec 2023 (announced 31 Jan 2024)	KV botnet disruption	Court-authorised removal of malware from hundreds of US SOHO routers, mostly end-of-life Cisco and NETGEAR	US DOJ
7 Feb 2024	AA24-038A	Joint advisory confirming pre-positioning and access of at least five years at some victims	CISA and partners
From 12 June 2024	Versa Director zero-day	CVE-2024-39717 exploited against ISPs, MSPs and IT firms; KEV listed 23 August 2024	Lumen (moderate confidence)
2025 (published Feb 2026)	Pipeline and utility intrusions	VOLTZITE used Sierra Wireless AirLink cellular gateways to reach US midstream pipeline operations and took configuration and alarm data; SYLVANITE exploited Ivanti flaws at electric and water utilities	Dragos 2026 OT report via iTWire

Ivanti Connect Secure appears in AA24-038A's list of exploited appliances. For how VPN zero-days expose stored credentials and service accounts, see the Ivanti Connect Secure Exploitation 2024 analysis (that page does not attribute the activity to Volt Typhoon).

Detection and defence

Detection reference

Event or signal	Source	What it can indicate
ESENT 216, 325, 326, 327, 637	Windows Application log on domain controllers	NTDS.dit copied or staged
Event ID 1102	Windows Security log	Audit log cleared
Event IDs 21 to 25	TerminalServices-LocalSessionManager	RDP sessions, especially by unexpected users
Event ID 4624 queried by PowerShell	PowerShell script block logging	Reconnaissance of logon history
Unusual files in C:\Windows\Temp or C:\Users\Public	EDR, file monitoring	Staging of tools or archives
Impossible travel or residential IPs on VPN	VPN and identity logs	Logins via proxy botnets
Anomalous IT to OT connections	Network monitoring at the IT/OT boundary	Movement towards control systems

Eviction and hardening, in order

Patch and reduce the edge: prioritise appliances the group exploits, remove HTTP and SSH management interfaces from the internet, and replace end-of-life devices. See the Edge Device Security Guide.
Enforce phishing-resistant MFA on VPN and all remote access, the second of the advisory's top mitigations.
Centralise and protect logs: forward domain controller, VPN and appliance logs to a SIEM with retention long enough to cover multi-year dwell. See the Log Management and Retention Guide.
Hunt before you evict: scope every compromised account and foothold first, because partial clean-up tells the actor it has been seen and it re-targets the same organisations.
Reset domain credentials as a full compromise: if NTDS.dit theft is suspected, plan a coordinated reset of all accounts, including service accounts and the KRBTGT account twice, in a tested sequence with a rollback plan for broken services.
Separate IT and OT identities and change default OT vendor credentials.

Pilot new detection rules in alert-only mode for two to four weeks to tune out normal administrator use of ntdsutil, vssadmin and RDP before automating responses.

Decision guidance

Small utilities and municipalities with limited staff should prioritise edge patching, MFA and replacing end-of-life routers and VPNs, and use CISA's free services and sector ISACs for threat intelligence. Larger operators should add continuous hunting against the detection table, IT/OT network monitoring and a rehearsed domain-wide credential reset. Service providers should assume their management platforms are a route to customers and protect them like Tier 0.

Metrics

Edge patch latency: days from KEV listing to patch on internet-facing appliances.
End-of-life exposure: count of unsupported edge devices still in service.
MFA coverage: percentage of remote access accounts on phishing-resistant MFA.
Log coverage and retention: percentage of domain controllers and edge devices forwarding logs, and retention in months.
Hunting cadence: number of hunts per quarter against the advisory's indicators, and time to investigate a 1102 or ESENT alert.

Framework mapping

Risk	NIST CSF 2.0	NIST SP 800-53 Rev. 5
Exploited and end-of-life edge devices	PR.PS-02	SI-2, RA-5, SC-7
Stolen domain and appliance credentials	PR.AA-01, PR.AA-03, PR.AA-05	IA-2(1), IA-5, AC-2, AC-6
Living off the land and log clearing	DE.CM-01, DE.CM-09, DE.AE-02	SI-4, AU-6, AU-9, AU-12
IT to OT movement	PR.IR-01	SC-7, AC-17
Threat intelligence intake	ID.RA-02	RA-5

Common failure patterns

Treating it as a malware problem: antivirus finds nothing because there is little malware to find.
Short log retention: with access lasting years, 30 or 90 days of logs cannot show when it started.
AD-bound service accounts on edge appliances: one compromised firewall hands over a domain credential.
Keeping end-of-life routers and VPNs: the KV botnet was built mostly from unsupported devices.
Partial eviction: resetting a few accounts after an NTDS.dit theft leaves the rest of the hashes usable.

Practitioner checklist

Inventory internet-facing appliances and confirm patch status against KEV, including CVE-2024-39717.
Replace end-of-life SOHO routers, VPNs and firewalls.
Remove stored credentials and unneeded AD binds from edge devices.
Enforce phishing-resistant MFA on all remote access.
Alert on ESENT 216/325/326/327/637, Event ID 1102 and unexpected RDP sessions.
Enable LSA protection and Credential Guard on domain controllers and admin hosts.
Retain domain controller and VPN logs for at least a year where feasible.
Separate IT and OT accounts and change default OT vendor passwords.
Prepare and test a domain-wide credential reset runbook.

Volt Typhoon Threat Actor Profile: Living off the Land in Critical Infrastructure