SOCRadar LABS - Tests On Your Security Posture

Search Again

Volt Typhoon

Get Free Access to Insights

Summary of Actor:Volt Typhoon is a state-sponsored cyber espionage group believed to be affiliated with China. It is known for targeting critical infrastructure organizations in various countries, primarily focusing on obtaining intelligence. This group employs sophisticated techniques to remain undetected for long periods.

General Features:State-sponsored, focused on cyber espionage, highly sophisticated, employs stealthy and persistent attack methods.

Related Other Groups: APT41,APT10,RedEcho

Indicators of Attack (IoA):

Unauthorized access to network devices
Use of living-off-the-land techniques
Unusual outbound network traffic
Presence of command-and-control communications

Recent Activities and Trends:

Latest Campaigns : Volt Typhoon has recently been linked to attacks targeting the energy and telecommunications sectors in the United States. These attacks are aimed at exfiltrating sensitive information related to critical infrastructure and national security.
Emerging Trends : Recent observations indicate a shift towards using more advanced living-off-the-land techniques and exploits for zero-day vulnerabilities. There is also an increased focus on long-term persistence and undetected presence within target environments.

...

Also Known As:

VOLTZITE

Vanguard Panda

Volt Typhoon

Bronze Silhouette

Target Countries

Australia

India

USA

Target Sectors

Energy & Utilities

Construction

Manufacturing

Transportation&Warehousing

Educational Services

Associated Malware/Software

sh.kv

HiatusRAT

win.scanline

️Related CVEs

ATT&CK IDs:

T1105

T1593

T1583.005

T1210

T1592

+44

Tactic	Id	Technique
Collection	T1530	Data from Cloud Storage	Sub Techniques	Detections	Mitigations
Command And Control	T1573	Encrypted Channel	Sub Techniques	Detections	Mitigations
Command And Control	T1105	Ingress Tool Transfer	Sub Techniques	Detections	Mitigations
Command And Control	T1071	Application Layer Protocol	Sub Techniques	Detections	Mitigations
Command And Control	T1090	Proxy	Sub Techniques	Detections	Mitigations
Credential Access	T1555	Credentials from Password Stores	Sub Techniques	Detections	Mitigations
Credential Access	T1040	Network Sniffing	Sub Techniques	Detections	Mitigations
Credential Access	T1110	Brute Force	Sub Techniques	Detections	Mitigations
Credential Access	T1003	OS Credential Dumping	Sub Techniques	Detections	Mitigations
Defense Evasion	T1112	Modify Registry	Sub Techniques	Detections	Mitigations
Defense Evasion	T1036	Masquerading	Sub Techniques	Detections	Mitigations
Defense Evasion	T1553	Subvert Trust Controls	Sub Techniques	Detections	Mitigations
Defense Evasion	T1055	Process Injection	Sub Techniques	Detections	Mitigations
Defense Evasion	T1070	Indicator Removal	Sub Techniques	Detections	Mitigations
Defense Evasion	T1078	Valid Accounts	Sub Techniques	Detections	Mitigations
Discovery	T1033	System Owner/User Discovery	Sub Techniques	Detections	Mitigations
Discovery	T1057	Process Discovery	Sub Techniques	Detections	Mitigations
Discovery	T1007	System Service Discovery	Sub Techniques	Detections	Mitigations
Discovery	T1040	Network Sniffing	Sub Techniques	Detections	Mitigations
Discovery	T1082	System Information Discovery	Sub Techniques	Detections	Mitigations
Discovery	T1087	Account Discovery	Sub Techniques	Detections	Mitigations
Discovery	T1016	System Network Configuration Discovery	Sub Techniques	Detections	Mitigations
Discovery	T1069	Permission Groups Discovery	Sub Techniques	Detections	Mitigations
Execution	T1059	Command and Scripting Interpreter	Sub Techniques	Detections	Mitigations
Execution	T1106	Native API	Sub Techniques	Detections	Mitigations
Execution	T1569	System Services	Sub Techniques	Detections	Mitigations
Execution	T1047	Windows Management Instrumentation	Sub Techniques	Detections	Mitigations
Exfiltration	T1048	Exfiltration Over Alternative Protocol	Sub Techniques	Detections	Mitigations
Impact	T1531	Account Access Removal	Sub Techniques	Detections	Mitigations
Impact	T1490	Inhibit System Recovery	Sub Techniques	Detections	Mitigations
Initial Access	T1195	Supply Chain Compromise	Sub Techniques	Detections	Mitigations
Initial Access	T1190	Exploit Public-Facing Application	Sub Techniques	Detections	Mitigations
Initial Access	T1566	Phishing	Sub Techniques	Detections	Mitigations
Initial Access	T1199	Trusted Relationship	Sub Techniques	Detections	Mitigations
Initial Access	T1133	External Remote Services	Sub Techniques	Detections	Mitigations
Initial Access	T1078	Valid Accounts	Sub Techniques	Detections	Mitigations
Lateral Movement	T1210	Exploitation of Remote Services	Sub Techniques	Detections	Mitigations
Lateral Movement	T1021	Remote Services	Sub Techniques	Detections	Mitigations
Persistence	T1547	Boot or Logon Autostart Execution	Sub Techniques	Detections	Mitigations
Persistence	T1546	Event Triggered Execution	Sub Techniques	Detections	Mitigations
Persistence	T1133	External Remote Services	Sub Techniques	Detections	Mitigations
Persistence	T1505	Server Software Component	Sub Techniques	Detections	Mitigations
Persistence	T1078	Valid Accounts	Sub Techniques	Detections	Mitigations
Privilege Escalation	T1547	Boot or Logon Autostart Execution	Sub Techniques	Detections	Mitigations
Privilege Escalation	T1055	Process Injection	Sub Techniques	Detections	Mitigations
Privilege Escalation	T1068	Exploitation for Privilege Escalation	Sub Techniques	Detections	Mitigations
Privilege Escalation	T1546	Event Triggered Execution	Sub Techniques	Detections	Mitigations
Privilege Escalation	T1078	Valid Accounts	Sub Techniques	Detections	Mitigations
Reconnaissance	T1593	Search Open Websites/Domains	Sub Techniques	Detections	Mitigations
Reconnaissance	T1592	Gather Victim Host Information	Sub Techniques	Detections	Mitigations
Reconnaissance	T1595	Active Scanning	Sub Techniques	Detections	Mitigations
Reconnaissance	T1589	Gather Victim Identity Information	Sub Techniques	Detections	Mitigations
Resource Development	T1583	Acquire Infrastructure	Sub Techniques	Detections	Mitigations
Resource Development	T1587	Develop Capabilities	Sub Techniques	Detections	Mitigations