Quick links
Press Enter to search, Esc to close
Threat group profile
Attributed by the US government and its Five Eyes partners to a People's Republic of China state-sponsored actor, Volt Typhoon is described in US advisories as pre-positioning inside critical infrastructure IT networks to be able to disrupt operations in a crisis.
In short
Attributed by the US government and its Five Eyes partners to a People's Republic of China state-sponsored actor, Volt Typhoon is described in US advisories as pre-positioning inside critical infrastructure IT networks to be able to disrupt operations in a crisis. MITRE says it has been active since at least 2021.
Public reports use several names for this activity.
| Name | Where it appears |
|---|---|
| Volt Typhoon | MITRE ATT&CK G1017 (group name); CISA advisories AA23-144A and AA24-038A[1, 6, 7] |
| Vanguard Panda | MITRE ATT&CK Associated Groups; CISA advisory AA24-038A[1, 7] |
| BRONZE SILHOUETTE | MITRE ATT&CK Associated Groups; CISA advisory AA24-038A[1, 7] |
| DEV-0391 | MITRE ATT&CK Associated Groups; CISA advisory AA24-038A; FBI affidavit of December 2023 (a/k/a DEV-0391)[1, 7, 16] |
| UNC3236 | MITRE ATT&CK Associated Groups; CISA advisory AA24-038A[1, 7] |
| Voltzite | MITRE ATT&CK Associated Groups; CISA advisory AA24-038A[1, 7] |
| Insidious Taurus | MITRE ATT&CK Associated Groups; CISA advisory AA24-038A[1, 7] |
| DazedToad | MITRE ATT&CK Associated Groups only[1] |
Attribution is a judgment by the body named. It is shown here as attributed, not as proven fact.
CISA, NSA, FBI with Australian, Canadian, New Zealand and UK agencies 24 May 2023
Issued a joint advisory on a PRC state-sponsored cyber actor "also known as Volt Typhoon". Said the actor relies on living off the land and the agencies believe the same techniques could be used against other sectors worldwide.[6]
US District Court, Southern District of Texas (FBI affidavit) 6 December 2023
In a sworn FBI affidavit for a search warrant, the FBI described the KV Botnet as one form of infrastructure used by Volt Typhoon. The court issued the warrant.[16]
CISA and FBI 31 January 2024
Said the PRC-sponsored Volt Typhoon group was behind recent activity against small office and home office routers, in a Secure by Design alert to router makers.[15]
CISA, NSA, FBI (AA24-038A) 7 February 2024
Assessed with high confidence that Volt Typhoon is pre-positioning on IT networks to allow movement to operational technology and disruption. Said it had compromised the IT environments of several critical infrastructure organizations.[7]
UK National Cyber Security Centre 7 February 2024
Said a joint advisory gave details of China state-sponsored actor Volt Typhoon, seen using living off the land techniques against US critical infrastructure. Assessed that this kind of activity is likely a threat to UK critical national infrastructure.[11]
CISA, NSA, FBI and partners 19 March 2024
Published a fact sheet for leaders saying the US agencies assess the PRC-sponsored group "Volt Typhoon" is seeking to pre-position for disruptive or destructive activity.[12]
Canadian Centre for Cyber Security 19 March 2024
Joined the US agencies and partners in the fact sheet for leaders on PRC state-sponsored activity such as Volt Typhoon.[14]
NCSC New Zealand 20 March 2024
Said Volt Typhoon has been pre-positioning to enable disruption or destruction of critical services in a time of geopolitical tension or military conflict involving the US and its allies.[13]
FBI Director Christopher Wray 24 July 2024
Told the House Judiciary Committee that the FBI and partners had identified a network of hundreds of compromised routers used by the PRC-sponsored hacking group known as Volt Typhoon, and ran a court-authorized operation against it.[17]
CISA Director 15 January 2025
Wrote that the "Volt Typhoon" campaign was designed to disrupt or destroy critical infrastructure, and that CISA teams had deployed to find and remove PRC activity.[18]
CISA (China threat page, undated, read 9 October 2026) Page read 9 October 2026
Names Volt Typhoon with Salt Typhoon and says CISA, NSA and FBI assess Chinese government-linked actors are positioning inside IT networks to allow movement to operational technology.[19]
MITRE ATT&CK Page last modified 31 July 2026
Describes Volt Typhoon as a PRC state-sponsored actor, active since at least 2021, that mainly targets US critical infrastructure including Guam.[1]
Sources differ on a few details. On the router botnet, the court warrant was issued on 6 December 2023, the FBI Director says the FBI announced the operation in January 2024, and MITRE says US law enforcement disrupted it in "early 2024". On router makers, the FBI affidavit and advisory AA24-038A name Cisco and NETGEAR, while MITRE also lists DrayTek. None of the opened sources names a PRC agency or unit behind the group.
Each entry is attributed to the group by the sources cited.
MITRE describes the group as active since at least 2021.[1]
MITRE gives October 2022 as the first sighting of the KV botnet campaign, which used end-of-life routers to hide the group's connections.[2]
US, Australian, Canadian, New Zealand and UK agencies publish AA23-144A on the actor known as Volt Typhoon and its use of built-in Windows tools.[6]
A US court issues a search and seizure warrant so the FBI can remotely delete KV botnet malware from infected US routers.[16]
CISA and FBI urge makers of small office and home office routers to build in better security, citing Volt Typhoon.[15]
AA24-038A says US agencies assess with high confidence the group is pre-positioning on IT networks, and that they saw signs of access kept in some victims for at least five years.[7]
Joint guidance on spotting built-in tool abuse is released with the advisory.[10]
The FBI Director describes the router botnet operation to the House Judiciary Committee.[17]
CISA describes the Volt Typhoon campaign as designed to disrupt or destroy critical infrastructure and says its teams are helping victims.[18]
CISA's China threat page cites the 2026 ODNI Annual Threat Assessment and names Volt Typhoon with Salt Typhoon.[19]
Indictments, sanctions and advisories that name the group or its alleged members.
| Date | Who | What |
|---|---|---|
| 24 May 2023 | CISA, NSA, FBI, ACSC, Canadian Cyber Centre, NCSC-NZ, NCSC-UK | Joint advisoryAA23-144A on the PRC state-sponsored actor known as Volt Typhoon, with hunting and logging advice.[6] |
| 6 December 2023 | US District Court, Southern District of Texas | Search and seizure warrantIssued on an FBI application so the FBI could remotely search infected US routers, delete KV botnet malware and take limited steps to stop re-infection.[16] |
| January 2024 | FBI | Court-authorized operation announcedThe FBI Director says the operation significantly disrupted the Volt Typhoon botnet and the access it gave.[17] |
| 31 January 2024 | CISA and FBI | Secure by Design alertAsks router makers to improve product security, citing Volt Typhoon.[15] |
| 7 February 2024 | CISA, NSA, FBI with DOE, EPA, TSA and partners from Australia, Canada, New Zealand and the UK | Joint advisory and guidanceAA24-038A and the living off the land guide.[7, 10] |
| 7 February 2024 | UK National Cyber Security Centre | Public warningUrges UK critical infrastructure operators to follow the advice.[11] |
| 19 March 2024 | CISA, NSA, FBI and partners including the Canadian Cyber Centre | Fact sheet for leadersSets out actions for executives of critical infrastructure organizations.[12, 14] |
| 20 March 2024 | NCSC New Zealand | Publication of the fact sheetNCSC-NZ announces the fact sheet with ten international partners.[13] |
| 15 January 2025 | CISA | Public statement on response workCISA Director says hunt and incident response teams deployed to find and remove PRC activity across sectors.[18] |
Techniques reported for this group, by MITRE ATT&CK tactic.
Gather Victim Identity Information: Email Addresses T1589.002
MITRE says the group targeted the personal emails of key network and IT staff at victims.[1, 7]
Gather Victim Network Information T1590
MITRE says the group did extensive checks to learn the target's network, including its layout and security tools.[1, 7]
Compromise Infrastructure: Network Devices T1584.008
MITRE and the advisories say compromised small office and home office routers were used to relay traffic, often near the victim.[1, 6, 7]
Develop Capabilities: Exploits T1587.004
MITRE says the group has exploited zero-day flaws for initial access.[1, 3]
External Remote Services T1133
The advisory says the group often uses VPN sessions to connect to victim environments.[1, 7]
Valid Accounts: Domain Accounts T1078.002
MITRE says the group relies mainly on valid credentials for persistence and has used compromised domain accounts.[1, 7]
Server Software Component: Web Shell T1505.003
MITRE says the group has used web shells, including in the Versa Director campaign.[1, 3, 6]
KV Botnet malware Router malware
MITRE and the FBI describe malware on infected end-of-life routers that links them into a relay network the group used to hide its connections.[2, 16]
VersaMem Web shell
MITRE says it was deployed on Versa Director servers to capture credentials and run further code in the 2024 campaign.[5, 3]
FRP (Fast Reverse Proxy) Proxy tool
MITRE describes FRP as an openly available tool, and the May 2023 advisory says the actor used a custom FRP client.[4, 6, 1]
Earthworm Proxy tool
The May 2023 advisory and MITRE say the group used Earthworm with FRP to proxy network traffic.[6, 1]
Awen web shell Web shell
MITRE says the group used a version of the Awen web shell with encrypted command traffic. The 2023 advisory says some web shells came from it.[1, 6]
Impacket Open-source toolkit
MITRE lists the group as using customized versions of open-source tools such as Impacket to proxy traffic.[1]
Built-in Windows tools (wmic, ntdsutil, netsh, PowerShell) Living off the land
The 2023 advisory lists these built-in tools as ones the actor uses to blend in with normal activity.[6]
Also linked in our threat library:
See which firewalls, VPNs, routers and management pages face the internet, the exposure the advisories ask you to reduce.
Follow what governments and MITRE report about this group and compare its listed techniques with your own controls.
Watch for leaked or sold company credentials, since the advisories describe the group relying on valid accounts.
Check for exposed personal details of IT and security staff, since the advisory says their personal email is targeted.
Bring exposure, intelligence and monitoring findings into one place for your security team.
MITRE ATT&CK describes it as a PRC state-sponsored actor active since at least 2021. The US government and its Five Eyes partners have attributed the activity to it, as shown in the 2023 and 2024 joint advisories.
CISA, NSA and FBI assessed in February 2024, with high confidence, that the group is pre-positioning on IT networks to be able to reach operational technology and disrupt services in a crisis or conflict with the US.
US agencies say they confirmed compromises mainly in Communications, Energy, Transportation Systems, and Water and Wastewater Systems, including in Guam.
The advisory says it typically exploits known or zero-day flaws in public-facing network devices such as routers, VPNs and firewalls, then connects over VPN and uses valid accounts and built-in tools.
The FBI describes it as a network of infected end-of-life small office and home office routers, mostly Cisco and NETGEAR, used as relays to hide the group's activity. A court issued a warrant on 6 December 2023, and the FBI Director says the FBI announced the operation in January 2024.
Patch and close off internet-facing devices, stop storing credentials on edge devices, require phishing-resistant multi-factor sign-in, and turn on central logging, as the February 2024 advisory advises.
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.