CISA, NSA and the FBI, with partners, say in advisory AA24-038A (released 7 February 2024) that PRC state-sponsored actors are pre-positioning on IT networks of U.S. critical infrastructure. The advisory says they are attributed by CISA and partners to a group it calls Volt Typhoon, and that some footholds lasted at least five years. This note summarizes what the advisory states, nothing more.
Who published the advisory and what does it assess?
CISA, NSA and the FBI wrote it. The release date is 7 February 2024. The advisory lists these partners: the U.S. Department of Energy, the Environmental Protection Agency, the Transportation Security Administration, Australia’s ACSC, the Canadian Centre for Cyber Security, the UK NCSC and the New Zealand NCSC.
The U.S. agencies assess that the actors want to pre-position for “disruptive or destructive cyberattacks” in the event of a major crisis or conflict. They assess with high confidence that the aim is lateral movement from IT to OT assets. The advisory says the actors compromised IT environments mainly in Communications, Energy, Transportation Systems and Water and Wastewater Systems, including Guam. It names the group Volt Typhoon and lists other names for it: Vanguard Panda, BRONZE SILHOUETTE, Dev-0391, UNC3236, Voltzite and Insidious Taurus.
How did the actors get in, and through which devices?
The advisory says the actors typically gain initial access by exploiting known or zero-day vulnerabilities in public-facing network appliances, named as routers, VPNs and firewalls [T1190]. It lists appliances from Fortinet, Ivanti Connect Secure, NETGEAR, Citrix and Cisco. In one confirmed case it says the actors likely used CVE-2022-42475 on an unpatched FortiGate 300D firewall, with a buffer overflow seen in SSL-VPN crash logs.
Other exploited flaws in products from some of these vendors have their own pages: FortiOS (CVE-2024-21762), Ivanti Connect Secure (CVE-2025-0282) and Citrix Bleed (CVE-2023-4966).
After that, the advisory says, they often connect through VPN sessions [T1133]. The exploit of a public-facing application is the entry, and the VPN is how they return. Before any of this, the advisory describes extensive reconnaissance [TA0043], including searches with FOFA, Shodan and Censys, per industry reporting.
The flow below follows the order in which the advisory describes the activity.
- Pre-compromise reconnaissanceLearn the network, staff and exposed devicesTactic TA0043 (MITRE ATT&CK, opens in a new tab)
- Exploit a public-facing applianceRouter, VPN or firewallTechnique T1190 (MITRE ATT&CK, opens in a new tab)
- Connect over VPNDiscreet follow-on activityTechnique T1133 (MITRE ATT&CK, opens in a new tab)
- Dump Active Directory credentialsNTDS.dit taken from domain controllersTechnique T1003.003 (MITRE ATT&CK, opens in a new tab)
- Move laterally by RDPValid administrator credentialsTechnique T1021.001 (MITRE ATT&CK, opens in a new tab)
- Proxy command and controlMulti-hop proxy of VPS or SOHO routersTechnique T1090.003 (MITRE ATT&CK, opens in a new tab)
What did they do once inside?
The advisory says the actors rarely use malware after compromise. They use hands-on-keyboard commands and native tools, known as living off the land, with valid accounts as the main route to persistence [T1078]. It lists tools such as certutil, netsh, nltest, ntdsutil, wmic and PowerShell.
For credentials, it describes copying the Active Directory database NTDS.dit through a volume shadow copy [T1003.003], after an RDP session to the domain controller [T1021.001]. It also describes LSASS memory dumps using an outdated comsvcs.dll [T1003.001], and Mimikatz. For discovery it lists system, network service, group and user discovery [T1082, T1046, T1069, T1033]. For defense evasion it describes clearing Windows event logs [T1685.005, formerly T1070.001] and packing tools with UPX [T1027.002].
On lateral movement, the advisory gives one water and wastewater case. The actors used a VPN with administrator credentials, then moved over nine months to a file server, a domain controller, an Oracle Management Server and a VMware vCenter server. It says the vCenter server was adjacent to OT assets, and the actors enumerated stored PuTTY sessions there. In collection, it says they gathered OT diagrams and documentation, including for SCADA systems, relays and switchgear.
How did they hide their command and control?
The advisory says the actors historically used multi-hop proxies built from virtual private servers or small office and home office routers [T1090.003]. It says they recently used end-of-life Cisco and NETGEAR SOHO routers implanted with KV Botnet malware, and points to a U.S. Department of Justice press release. It also describes Fast Reverse Proxy clients on victim servers [T1090], and a monitoring server turned into a proxy with a netsh PortProxy change [T1090.001].
How long was the access observed to last?
The advisory states that the U.S. agencies “recently observed indications” of the actors keeping footholds in some victim IT environments for at least five years. It also says they re-target the same organizations over years. In one compromise it says NTDS.dit was likely extracted from three domain controllers in four years. In another, twice in nine months. The advisory ties this to its view that the aim is persistence, not immediate exploitation.
Which dates does the advisory give?
Three dated events appear in the text.
- May 2023Earlier joint advisoryAgencies and industry partners disclosed Volt Typhoon activity.
- 7 February 2024AA24-038A releasedInitial version.
- 7 March 2024Mitigations updatedAdded a recommendation on end-of-life technology.
What does the advisory recommend?
The advisory groups its advice into hunting, response and hardening. These are its recommendations, not ours.
- Hunt: review application, security and system event logs, with attention to ESENT event IDs 216, 325, 326 and 327 as possible signs of NTDS.dit copying. Investigate every event ID 1102. Review VPN logins for impossible travel and check C:\Windows\Temp and C:\Users\Public for unusual files.
- Patch and reduce exposure: patch internet-facing systems, prioritize appliances it names, limit internet exposure, and plan for end-of-life technology.
- Protect credentials: do not store credentials on edge devices, use phishing-resistant MFA, separate user and privileged accounts, and use passwords of at least 15 characters.
- Logging: turn on application, access and security logs and keep them in a central system.
- If compromise is found: assume full domain compromise, sever the network from the internet where possible, reset all domain and local account passwords including krbtgt (twice), and audit network device configurations.
The method behind MITRE ATT&CK ids here is the advisory’s own: it uses ATT&CK for Enterprise version 14.
What are the limits of this note?
We read one advisory text and report its claims. We did not check the technical claims against other sources, and the advisory gives no victim counts. Several observations are marked “likely” or come from industry reporting, and we keep that wording. For comparison with other joint advisories, see our notes on AA25-141A and AA24-109A.