Volt Typhoon

Overview

Volt Typhoon is a People's Republic of China (PRC) state-sponsored actor that has been active since at least 2021, primarily targeting critical infrastructure organizations in the US and its territories including Guam. Volt Typhoon's targeting and pattern of behavior have been assessed as pre-positioning to enable lateral movement to operational technology (OT) assets for potential destructive or disruptive attacks. Volt Typhoon has emphasized stealth in operations using web shells, living-off-the-land (LOTL) binaries, hands on keyboard activities, and stolen credentials.. The group has leveraged compromised SOHO routers to proxy command and control traffic and obscure its infrastructure, activity associated with the KV botnet.. Reporting indicates a separate initial access cluster, SYLVANITE, has been observed exploiting internet-facing edge devices and transferring access to Volt Typhoon, also tracked as VOLTZITE, for follow-on operations.

Naming & attribution

Volt Typhoon is tracked under 8 names across the industry. It uses 81 documented ATT&CK techniques — more than 97% of the 174 groups tracked here. Activity attributed since at least 2021.

Distinctive techniques

Techniques this group uses that are rare across the other 173 tracked groups — these carry more signal than the near-universal ones.

• T1552 Unsecured Credentials — used by 1 of 174 groups
• T1590.006 Network Security Appliances — used by 1 of 174 groups
• T1592 Gather Victim Host Information — used by 1 of 174 groups
• T1006 Direct Volume Access — used by 2 of 174 groups
• T1070.007 Clear Network Connection History and Configurations — used by 2 of 174 groups
• T1218 System Binary Proxy Execution — used by 2 of 174 groups
• T1584.003 Virtual Private Server — used by 2 of 174 groups
• T1596.005 Scan Databases — used by 2 of 174 groups

Closest groups by technique overlap

Computed from shared ATT&CK techniques. Overlap is not attribution — distinct actors converge on the same tradecraft — but a high share is a useful pivot.

• OilRig Iran — 34 shared techniques (28% overlap)
• Chimera China — 31 shared techniques (28% overlap)
• APT41 China — 35 shared techniques (27% overlap)
• FIN13 — 27 shared techniques (25% overlap)
• Turla Russia — 29 shared techniques (24% overlap)
• Sandworm Team Russia — 30 shared techniques (23% overlap)

Capabilities

• Exploitation of public-facing / client applications — ATT&CK T1190

TTPs — 81 techniques across 13 tactics

Tools & malware (17)

netsh · PsExec · ipconfig · Wevtutil · VersaMem · Tasklist · Mimikatz · Ping · Impacket · Systeminfo · netstat · Nltest · certutil · Reg · FRP · cmd · Net

Reporting (3)

• Introducing the 2026 Cloudflare Threat Report — Cloudflare
• 9TH ANNUAL YEAR IN REVIEW | OT/ICS CYBERSECURITY REPORT — Dragos
• PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure — CISA et al.