Volt Typhoon

Volt Typhoon is a People's Republic of China (PRC) state-sponsored actor that has been active since at least 2021, primarily targeting critical infrastructure organizations in the US and its territories including Guam. The group's targeting and behavior patterns suggest pre-positioning to enable lateral movement to operational technology (OT) assets for potential disruptive actions. Volt Typhoon emphasizes stealth through techniques such as web shells, living-off-the-land binaries, and stolen credentials, while using compromised SOHO routers to obscure command and control traffic.