In May 2023, CISA, the NSA, the FBI, and intelligence agencies from Australia, Canada, New Zealand, and the United Kingdom published a joint advisory about a Chinese state-sponsored hacking group called Volt Typhoon. The advisory described intrusions into critical infrastructure networks - power grids, water systems, transportation networks, communications infrastructure - that did not follow the usual patterns of cyber espionage.
The attackers were not stealing intellectual property or collecting intelligence. They were establishing persistence. They were pre-positioning: gaining access to systems controlling critical infrastructure and maintaining that access, quietly, without doing anything visible. The advisory characterized the behavior as consistent with preparation for "disruptive or destructive cyberattacks" in the event of a major conflict with the US, specifically in the context of a potential crisis in the Taiwan Strait.
Pre-Positioning as a Strategy
Cyber operations during conflicts fall into several categories. Espionage operations collect intelligence. Disruptive operations impair adversary capabilities. Destructive operations cause lasting damage. But there is a fourth category that receives less attention: pre-positioning operations that establish the conditions for future action without taking that action yet.
Pre-positioning in critical infrastructure is the cyber equivalent of pre-deploying forces to a theater before a conflict begins. You're not fighting yet. You're getting into position. When and if conflict comes, you can act faster and more effectively than if you had to fight your way in from a standing start. The positioning itself has deterrent and coercive value: an adversary that knows you have access to their power grid and water systems must factor that into their decision-making.
What made Volt Typhoon's operations notable was that the group appeared specifically focused on this pre-positioning mission, operating with unusual patience and discipline. They were in some networks for years. They moved slowly, avoided common detection signatures, and prioritized persistence over collection. The goal was not to steal anything now. The goal was to be there, ready, when needed.
Living Off the Land
Volt Typhoon's technical signature is "living off the land" at an unusually sophisticated level. The term refers to using tools and capabilities that are already present on compromised systems - native Windows utilities, built-in network protocols, legitimate management software - rather than introducing custom malware that might be detected. The approach trades speed and capability for stealth.
On a typical Volt Typhoon intrusion, the group enters through an internet-facing device - a router, a VPN appliance, a firewall - using compromised credentials or an exploited vulnerability. Once inside, they use native tools: netsh for network configuration changes, PowerShell for scripting, wmic for system information, ntdsutil for credential extraction, and similar built-in utilities. They route traffic through compromised SOHO (small office/home office) routers to mask the origin of their connections. They use the attacker's traffic looks like normal network management activity because they're using the same tools that legitimate administrators use.
Vendor-specific knowledge is another characteristic. Volt Typhoon operators demonstrate detailed familiarity with specific industrial control systems, SCADA platforms, and OT environments used in US critical infrastructure. This knowledge suggests either substantial prior reconnaissance, access to documentation and training materials, or personnel with direct experience in these systems. It goes significantly beyond what would be needed for a general espionage mission.
The Sectors Targeted
The joint advisories from CISA and its international partners identified compromised organizations across multiple critical infrastructure sectors: communications, energy, transportation systems, and water and wastewater systems. The geographic distribution was broad, spanning the continental US and US territories in the Pacific - specifically Guam, a US territory with significant military infrastructure that would be central to any Taiwan contingency.
The focus on Guam was explicitly noted in the May 2023 advisory. Guam hosts Anderson Air Force Base, Apra Harbor Naval Base, and communications infrastructure supporting US operations throughout the Pacific. The advisories characterized Volt Typhoon's presence in Guam's critical infrastructure as particularly significant given its strategic role in any potential Taiwan conflict scenario.
The Taiwan Context
The advisories explicitly connected Volt Typhoon to the Taiwan Strait. This is an unusual step for intelligence assessments, which typically attribute attacks to nation-state groups without speculating about strategic intent. The public attribution with explicit strategic framing suggested that US intelligence agencies wanted China to know that the US had identified the campaign and understood its purpose.
The Taiwan Strait scenario that motivates this concern is a potential Chinese military operation against Taiwan. In such a scenario, the PLA would face US military intervention as a near-certainty. Pre-positioned access to US critical infrastructure could be used to create civilian disruption that complicates US mobilization, deters escalation, or imposes costs that affect public and political support for intervention. Power outages in US cities and disruption of transportation networks are not decisive military capabilities, but they impose costs and create domestic pressure.
This is the same logic that has driven discussion of critical infrastructure vulnerability for decades. A 2003 RAND study, a 2007 Idaho National Lab experiment that demonstrated physical destruction of a generator through a network attack ("Aurora"), and countless classified assessments have all concluded that US critical infrastructure has exploitable vulnerabilities that an adversary could leverage during conflict. Volt Typhoon represents the exploitation of those vulnerabilities moving from theoretical to operational.
The Router Botnet Disruption
In January 2024, the Justice Department announced that the FBI had conducted a court-authorized operation to disrupt a Volt Typhoon botnet. The botnet consisted of hundreds of US-based SOHO routers that Volt Typhoon had compromised using the KV Botnet malware. The FBI operation deleted the malware from affected routers and blocked communications between the botnet and attacker infrastructure.
This type of operation - using legal authority to actively remediate compromised devices on domestic networks - is relatively rare and reflects the severity of the threat assessment. The FBI essentially broke into routers owned by US citizens and businesses, without their knowledge, to remove Chinese malware. The legal authority came from a court order under Rule 41 of the Federal Rules of Criminal Procedure, which allows search and seizure of property being used in criminal activity. The compromised routers, being used to route Chinese government cyber operations, qualified.
The operation disrupted one component of Volt Typhoon's infrastructure but did not remove the group's access to the critical infrastructure networks they had already penetrated. Those intrusions required individual remediation by the affected organizations - a harder, slower process.
Detection and Defense Challenges
Detecting Volt Typhoon activity is genuinely difficult. Living-off-the-land techniques produce minimal artifacts because the tools used are the same ones administrators use legitimately. Behavioral detection requires baselines - understanding what normal administrative activity looks like in a given environment - to identify anomalies. Many critical infrastructure organizations, which have historically focused on availability rather than security, lack the monitoring infrastructure and personnel to establish and maintain those baselines.
OT environments add additional complexity. Industrial control systems often run on isolated networks with air gaps or strict firewall rules between IT and OT environments. But in practice, those separations are rarely as clean as designed. Remote monitoring requirements, management interfaces, data historians that aggregate OT data for business systems, and temporary connections established for maintenance and troubleshooting all create pathways. Volt Typhoon's demonstrated ability to move from IT networks to OT systems suggests they understand and exploit these pathways.
The Strategic Problem
Volt Typhoon represents a strategic challenge that technical defenses alone cannot resolve. Even a perfectly secured critical infrastructure network - one that successfully detects and evicts Volt Typhoon access - does not resolve the underlying problem. China can invest in continued attempts to re-establish access. The defender has to succeed every time; the attacker only needs to succeed occasionally. And the attacker has more patience, because they're not trying to do anything visible yet.
The appropriate response involves both technical hardening and strategic signaling. CISA's public attribution served to signal to China that the operations were known and being countered. US cyber command has reportedly conducted "hunt forward" operations - deploying teams to allied networks to identify and characterize Volt Typhoon activity before it reaches US networks. Diplomatic conversations about norms for pre-positioning in critical infrastructure have occurred but produced no binding agreements.
The uncomfortable reality is that the US engages in similar pre-positioning operations against adversary infrastructure. The Stuxnet operation, which destroyed Iranian centrifuges, required years of prior access establishment. US Cyber Command's "persistent engagement" doctrine explicitly contemplates operating on adversary networks. Calling for norms against critical infrastructure pre-positioning requires the US to constrain its own offensive operations in ways it has historically been unwilling to do.
The Volt Typhoon campaign will continue, or something like it will continue, because the strategic logic that motivates it hasn't changed. The question is whether the US can raise the cost and difficulty of successful pre-positioning enough to shift that calculus - and whether the critical infrastructure that everything else depends on can be meaningfully hardened against an adversary with the patience, resources, and institutional knowledge that Volt Typhoon has demonstrated.