Volt Typhoon
View MITRE Group Page ↗Key Facts
- Attributed Country: People's Republic of China.
- ATT&CK Group Reference: G1017 (Volt Typhoon).
- Linked to 1 primary court prosecution record(s) with $150.0 million documented loss.
- Identified 0 individually charged operative(s) and 0 OFAC designation(s).
Primary ATT&CK Techniques Employed
| Technique | Frequency |
|---|---|
| T1078 Valid Accounts | 1 incidents |
| T1190 Exploit Public-Facing Application | 1 incidents |
| T1584 Compromise Infrastructure | 1 incidents |
| T1059.003 Windows Command Shell | 1 incidents |
| T1059 Command and Scripting Interpreter | 1 incidents |
| T1090.003 Multi-hop Proxy | 1 incidents |
| T1016 System Network Configuration Discovery | 1 incidents |
| T1018 Remote System Discovery | 1 incidents |
Prosecution Cases Attributed to Volt Typhoon
Volt Typhoon Critical Infrastructure Pre-Positioning
State-sponsored cyber group sponsored by the People's Republic of China breached dozens of U.S. critical infrastructure operators in communications, energy, transportation, and water systems to establish disruptive persistent access.
Documented TTP Signature for Volt Typhoon
Test Controls in Stack Audit →Adversaries obtain and misuse legitimate credentials of existing user accounts to maintain persistence and bypass controls.
Adversaries exploit vulnerabilities in internet-connected software such as web servers or VPN appliances.
Adversaries hijack third-party domains, servers, and routers to use as attack relay infrastructure.
Adversaries execute commands and batch scripts using the Windows cmd.exe command shell.
Adversaries abuse built-in command shells and scripting interpreters including PowerShell, Bash, and Windows cmd to execute administrative commands without dropping custom binaries.
Adversaries route command traffic through chained compromises such as hijacked SOHO routers or onion networks to conceal foreign operator origin.