Volt Typhoon
A Chinese state-sponsored actor that US and allied agencies say is positioning itself inside critical infrastructure networks for possible disruption during a crisis. It relies on valid accounts and built-in tools, so there may be little malware to find. Dragos said in February 2026 that the group remains active.
Threat actor profile. Last reviewed 3 November 2026.
Why It Matters
The February 2024 joint advisory says Volt Typhoon actors seek to pre-position on IT networks so they could carry out disruptive or destructive activity against US critical infrastructure during a major crisis or conflict.2 Named sectors are communications, energy, transport, and water and wastewater, and some environments showed footholds lasting at least five years.5
The confirmed victims in these sources are in the US and its territories. For the UK, the NCSC's wording matters: it assesses that it is likely this type of activity poses a threat to UK critical national infrastructure.3 That is a statement of threat and not a report of UK compromise. In April 2026 NCSC-UK and partners published an advisory on covert networks of compromised devices, saying Volt Typhoon used them to pre-position offensive capabilities on critical national infrastructure.6
Dragos goes further. It reports the group kept targeting US utilities through 2025, moved towards direct interaction with OT network-connected devices, and receives access from a separate group it tracks as SYLVANITE. Its CEO said sites in the US and NATO countries include some that will never be found.4,7 These are vendor claims, and the sources do not name a compromised UK site.
A blocklist or malware signature will not help much against activity that looks like an administrator at work. Knowing what normal looks like in your own network is probably the more useful investment, particularly around IT and OT links.
How It Attacks
Based on the 2024 joint advisory as summarised by Industrial Cyber, plus ATT&CK.5,1 Treat it as a typical pattern and not a fixed script.
- 1
Research the Target
Uses web searches and internet scanning tools to find exposed infrastructure, network details and key IT staff. Has also targeted those staff's personal email.
- 2
Exploit an Appliance
Exploits public-facing network appliances, including zero-days. Products named include Fortinet, Ivanti, NETGEAR, Citrix and Cisco.
- 3
Blend In
Uses VPN sessions and valid accounts that look like normal traffic, and routes activity through compromised small office and home routers.
- 4
Gain Administrator Rights
Obtains administrator credentials and moves laterally using remote access services such as RDP.
- 5
Explore With Built-In Tools
Uses living off the land binaries and native command-line tools for discovery, avoiding obvious malware.
- 6
Take the Domain
Extracts the Active Directory database from a domain controller, then likely cracks the password hashes offline.
- 7
Reach OT
Uses elevated credentials to access operational technology assets. Dragos reports configuration and alarm data being taken from engineering workstations.
Key Techniques
Selected from the group's ATT&CK v20 entry.1 ATT&CK lists many more, and a technique can sit under more than one tactic.
| ID | Technique | Tactic | What It Looks Like |
|---|---|---|---|
| T1591.004 | Identify Roles | Reconnaissance | Identifies key network and IT staff before compromise. |
| T1190 | Exploit Public-Facing Application | Initial Access | Exploits flaws in internet-facing software and appliances. |
| T1133 | External Remote Services | Persistence | Uses VPNs to connect to victim environments. |
| T1078 | Valid Accounts | Persistence | Relies mainly on valid credentials for persistence. |
| T1021.001 | Remote Desktop Protocol | Lateral Movement | Moves to domain controllers over RDP with an admin account. |
| T1218 | System Binary Proxy Execution | Stealth | Uses native tools and LOLBins to maintain and expand access. |
| T1003.003 | NTDS | Credential Access | Copies the Active Directory database to obtain password hashes. |
| T1560.001 | Archive via Utility | Collection | Archives the NTDS database with 7-Zip. |
| T1584.005 | Botnet | Resource Development | Uses end-of-life Cisco and NETGEAR routers with KV Botnet malware. |
| T1090 | Proxy | Command and Control | Proxies traffic through compromised devices, FRP, Earthworm and Impacket. |
Tools Observed
Native Windows Tools
Dual-Use and Open Source Tools
Malware
Lists come from ATT&CK and the US Justice Department.1,8 Most of these are legitimate tools, so finding one does not prove compromise. Look at who ran it, from where and why.
Vulnerabilities
Few CVEs are tied to this group in the sources reviewed. ATT&CK more broadly names flaws in Fortinet, Ivanti, NETGEAR, Citrix and Cisco products.1
End-of-life routers matter too. The KV Botnet was mainly built from Cisco and NETGEAR devices that no longer received updates.6,8
Key Events
Active from at least this year, according to ATT&CK.1
A US court-authorised operation removes KV Botnet malware from hundreds of routers. The Justice Department announces it on 31 January 2024.8
CISA, NSA, FBI and partners including NCSC-UK publish their joint advisory. The NCSC warns about the threat to UK critical national infrastructure.2,3
Zero-day exploitation of Versa Director against service providers.1
Dragos reports activity against US utilities through 2025 and the SYLVANITE access handoff.4,7
NCSC-UK and partners publish an advisory on China-nexus covert networks, naming Volt Typhoon.6
CISA launches CI Fortify on isolating critical services. CISA's acting director says it does not respond to any one actor.10
Warning Signs
Drawn from the advisories, ATT&CK and Dragos.5,6,1,7 None of these proves an attack alone, but each deserves a quick check.
- VPN connections from consumer broadband ranges, or from small office routers
- Domain controller activity that creates or copies the NTDS database
- Password-protected archives or disguised copies of the NTDS database
- Unusual access or protocols between IT and OT networks
- Engineering workstations exporting configuration or alarm data
- OT network traffic that differs from your normal baseline
- Server logs edited to remove connection details
Defences That Matter
Baseline and Centralise Logs
- Centralise logs in an out-of-band location, then baseline network, user and application activity.3
- Reduce alert noise and use user and entity behaviour analytics.3
- Monitor critical ICS audit trails, and alert on traffic outside normal operations.5
Know Your Edge
- Map edge devices and their expected connections, and question connections from consumer broadband ranges.6
- Replace end-of-life routers and appliances.8
- Require MFA for remote access.6
Harden Identity and Segment
- Use stronger authentication controls and application allow-listing.3
- Strengthen network segmentation and monitoring.3
- Protect VPN and jumphost credentials, which Dragos links to most of its incident response cases.7
Plan to Operate in Isolation
- Segment OT from other networks, with detailed emergency plans.10
- Make sure compromised systems can be restored while isolated.10
Would You Spot an Attacker Using Your Own Tools?
We can check your logging, identity and network segmentation against the methods in this profile, then help you close the gaps.
Sources
- MITRE ATT&CK: Volt Typhoon (G1017), ATT&CK v20
- CISA: bulletin on the advisory on PRC-sponsored Volt Typhoon activity and living off the land guidance, 7 February 2024
- NCSC: NCSC and partners issue warning about state-sponsored cyber attackers hiding on critical infrastructure networks, 7 February 2024
- The Record: Researchers warn Volt Typhoon still active in critical infrastructure, 19 February 2026
- Industrial Cyber: Global security partners issue advisory on state-sponsored Chinese hacker group Volt Typhoon, February 2024
- NCSC-UK and partners: Defending Against China-Nexus Covert Networks of Compromised Devices, 23 April 2026
- Dragos: Launched: 9th Annual OT Year in Review, 17 February 2026
- US Justice Department: US government disrupts botnet People's Republic of China used to conceal hacking of critical infrastructure, 31 January 2024
- CISA Known Exploited Vulnerabilities catalogue, version 2026.10.30
- The Record: CISA initiative aims for critical infrastructure to operate during cyberattacks, 6 May 2026
MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. ATT&CK terms of use.