In May 2023, Microsoft and a consortium of US government agencies published a joint advisory about a Chinese state-sponsored threat actor they called "Volt Typhoon." Unlike most nation-state threat actor disclosures, which describe intelligence collection or financial theft, the Volt Typhoon advisory described something more alarming: systematic, long-term intrusions into US critical infrastructure - water utilities, power grids, transportation systems, communications networks - for the apparent purpose of pre-positioning for potential disruptive or destructive attacks in the event of a conflict between the United States and China.

Volt Typhoon was not stealing data. The group's presence in compromised networks showed minimal data exfiltration. Instead, investigators found that Volt Typhoon had maintained persistent access to operational technology (OT) environments and had mapped network topology, identified critical systems, and established footholds from which they could cause disruption on command. The assessment from CISA, NSA, and FBI was unambiguous: "Volt Typhoon is pre-positioning itself on IT networks to enable lateral movement to OT assets to disrupt functions." The timing of any activation would likely coincide with a US-China military conflict, particularly one involving Taiwan.

Living Off the Land

Volt Typhoon's most distinctive technical characteristic was its use of "living off the land" (LOTL) techniques almost exclusively. Rather than deploying custom malware - which can be detected by endpoint security tools, signatures, or behavioral analysis - the group used built-in Windows and network tools already present on compromised systems. Commands executed through standard Windows utilities, native PowerShell, and legitimate network administration tools blended into the background noise of normal IT operations.

Specific tools observed included wmic (Windows Management Instrumentation command-line), ntdsutil (used to access Active Directory database), netsh (network configuration), and PsExec (a Sysinternals tool commonly used by administrators). The group also used built-in web shell functionality in exposed network devices rather than deploying standalone malware. Lateral movement was accomplished through legitimate credentials harvested from compromised systems.

The infrastructure used for C2 and data staging was compromised legitimate infrastructure rather than attacker-controlled servers. Volt Typhoon compromised small-office/home-office (SOHO) routers and other network devices to use as proxies - routing their traffic through legitimate-appearing IP addresses in the target country. This made network-based detection substantially harder: traffic from a Volt Typhoon operator in China appeared to originate from a domestic IP address.

[TECHNICAL NOTE]
Volt Typhoon's LOTL technique profile, per joint advisory: the group performed reconnaissance using living-off-the-land binaries (LOLBins) including wmic, ntdsutil, net, netsh, ipconfig, whoami, and certutil. They created web shells on internet-facing network devices by exploiting vulnerabilities in SOHO routers and edge devices (particularly Fortinet FortiGuard, NETGEAR, and Cisco RV-series routers with known CVEs). The SOHO router proxy network effectively anonymized their traffic. They used pass-the-hash authentication using captured NTLM hashes to move laterally without needing to crack passwords. Active Directory reconnaissance was performed using legitimate AD query tools. Data was staged using built-in archiving tools (7-zip, robocopy) and exfiltrated in small, infrequent bursts to avoid detection. The almost total absence of custom malware binaries made traditional signature-based detection ineffective; detection required behavioral analysis of tool usage patterns (e.g., ntdsutil being run by a process that shouldn't be running it, or wmic running in unusual network contexts).

The OT Targeting and Taiwan Context

The targeting of critical infrastructure OT environments - rather than IT networks for intelligence collection - was what distinguished the Volt Typhoon disclosure from other Chinese APT reporting. The specific sectors targeted included communications, energy, transportation, water and wastewater, and the defense industrial base. CISA assessed that Volt Typhoon had been maintaining access to some of these environments for five or more years.

The implied operational concept was a "pre-attack" capability: if China were to initiate military action against Taiwan, Volt Typhoon's embedded access could be activated to cause disruption to US critical infrastructure - complicating US military mobilization, sowing civilian panic, and potentially deterring intervention or slowing response. Power grid disruptions, water treatment interference, and transportation system outages all carry real-world consequences that go beyond data theft.

CISA Director Jen Easterly testified before Congress in January 2024 that Volt Typhoon represented "the defining threat of our generation." The scale of pre-positioning was described as broader and deeper than anything previously attributed to China. Western intelligence assessments suggested the group had been active since at least 2021, with some intrusions potentially predating that.

[WARNING]
The Volt Typhoon disclosures highlighted a fundamental tension in critical infrastructure cybersecurity: OT environments are often decades old, run on hardware and software that cannot be easily patched or replaced, and are connected to IT networks for operational efficiency in ways that create attack paths that weren't present when the original OT systems were designed. A water treatment plant running SCADA software from 2005 on hardware that hasn't been updated because any downtime risks public health cannot simply be patched against a nation-state APT. The remediation recommendations in the Volt Typhoon advisories - patch edge devices, audit authentication logs, implement network segmentation between IT and OT, use phishing-resistant MFA, hunt for LOLBin anomalies - are directionally correct but operationally difficult for resource-constrained utilities and municipal systems that may lack dedicated cybersecurity staff. Congress has proposed but not yet enacted legislation mandating minimum cybersecurity standards for critical infrastructure operators, a debate the Volt Typhoon disclosures significantly energized.

Detection and Response

The joint advisory from NSA, CISA, FBI, and Five Eyes partners (UK NCSC, Australian ASD, Canadian CCCS, New Zealand NCSC) provided specific detection guidance for Volt Typhoon activity. The guidance focused on detecting LOLBin abuse through behavioral analytics rather than signatures, since the tools themselves are legitimate. Key detection opportunities included: unusual use of certutil for file downloads, ntdsutil running outside of expected backup processes, large outbound transfers from OT network segments, authentication from SOHO router IPs, and web shell indicators on edge devices.

Several US utilities and critical infrastructure operators were notified directly by FBI and CISA that they had active Volt Typhoon intrusions in their networks. Remediation in OT environments required careful coordination to avoid disrupting operational systems during the eviction process. In some cases, organizations chose monitoring-first approaches - documenting the intrusion rather than immediately evicting the attackers - to fully map the scope of compromise before taking action that might trigger a response.

[IOC]
Volt Typhoon indicators from joint advisories: the group primarily used compromised SOHO and edge devices as proxies, making IP-based IOCs volatile and of limited value. Detection focus should be on behaviors: execution of ntdsutil, wmic, netsh, certutil with unusual arguments or from unexpected parent processes. Authentication events using NTLM from IP ranges associated with residential ISPs or hosting providers (proxy indicators). Web shell artifacts on edge devices (Fortinet, Cisco, NETGEAR - check for unexpected files in web roots or unusual HTTP POST traffic). Volt Typhoon has exploited CVEs in Fortinet FortiGuard (CVE-2022-40684), NETGEAR ProSAFE (multiple), Cisco Small Business RV-series (multiple), and other edge devices commonly deployed in critical infrastructure environments. CISA's advisory "Identifying and Mitigating Living Off the Land Techniques" (February 2024) provides specific detection queries for SIEM platforms. Mandiant tracks the group as UNC3236; CrowdStrike as Vanguard Panda; Secureworks as Bronze Silhouette.