volt-typhoon

name	volt-typhoon
description	Adversary-emulation profile for Volt Typhoon (G1017), a PRC state-sponsored actor pre-positioning in US critical infrastructure via living-off-the-land TTPs.
allowed-tools	Bash Read Write
metadata	{"subdomain":"adversary-emulation","when_to_use":"volt typhoon, bronze silhouette, vanguard panda, insidious taurus, voltzite, dev-0391, unc3236, G1017, PRC critical infrastructure, living off the land, LOTL, LOLBins, SOHO router botnet, KV botnet, OT pre-positioning, China state-sponsored stealth espionage emulation","tags":"adversary-emulation, china, prc, nation-state, critical-infrastructure, living-off-the-land, lotl, edge-devices, espionage, ot, stealth, G1017","mitre_attack":"T1590, T1590.004, T1590.006, T1591, T1591.004, T1589, T1589.002, T1592, T1593, T1594, T1596.005, T1583.003, T1584.003, T1584.004, T1584.005, T1584.008, T1587.001, T1587.004, T1588.002, T1588.006, T1190, T1133, T1078, T1078.002, T1059.001, T1059.003, T1059.004, T1047, T1218, T1505.003, T1003.001, T1003.003, T1555, T1555.003, T1552, T1552.004, T1556, T1068, T1070.001, T1070.004, T1070.007, T1027.002, T1036.004, T1036.005, T1036.008, T1112, T1497.001, T1140, T1090, T1090.001, T1090.003, T1071.001, T1573.001, T1573.002, T1095, T1571, T1105, T1570, T1021.001, T1087.001, T1087.002, T1069.001, T1069.002, T1016, T1049, T1018, T1057, T1046, T1518.001, T1654, T1005, T1560.001, T1074.001, T1056.001, T1113"}

Volt Typhoon (BRONZE SILHOUETTE, Vanguard Panda, Insidious Taurus) — Adversary Emulation Profile

Volt Typhoon is a People's Republic of China (PRC) state-sponsored cyber actor active since at least mid-2021, tracked by MITRE ATT&CK as G1017 and known by the aliases BRONZE SILHOUETTE (Secureworks), Vanguard Panda (CrowdStrike), Voltzite (Dragos), Insidious Taurus (Palo Alto Unit 42), DEV-0391 (Microsoft's pre-naming designation), and UNC3236 (Mandiant). Unlike financially motivated crews, Volt Typhoon's hallmark is patient, ultra-stealthy pre-positioning inside US critical infrastructure — communications, energy, water, and transportation — using almost exclusively living-off-the-land (LOTL) techniques and legitimate stolen credentials, with little or no custom malware on victim hosts. CISA, the NSA, and the FBI assess the group is establishing persistent access not for immediate espionage value but to enable lateral movement to operational technology (OT) for potential disruptive or destructive attacks during a future geopolitical crisis or conflict. Its operational signature is hands-on-keyboard activity, native OS binaries, web shells on edge appliances, and traffic proxied through compromised small-office/home-office (SOHO) routers to blend into normal network noise.

Attribution & motivation

• Sponsor / nation: People's Republic of China (PRC), state-sponsored. CISA/NSA/FBI and Microsoft attribute the activity to a PRC nexus; Microsoft assessed the actor as PRC state-sponsored with high confidence.
• Motivation: Strategic pre-positioning / preparation of the environment rather than classic data-theft espionage. Microsoft assessed with moderate confidence that the campaign pursues capabilities that could disrupt critical communications infrastructure between the US and the Asia region during a future crisis. CISA's AA24-038A frames the intent as enabling destructive or disruptive cyberattacks against OT in the event of conflict. This is closer to destructive/wartime-enabling than financial or influence motivation.
• Confidence: Attribution to a PRC state-sponsored actor is high (joint government + multiple vendor concurrence). The disruptive-intent assessment is moderate confidence per the original reporting.

Targeting

• Sectors: US critical infrastructure — communications, energy/utility (electric, water/wastewater), transportation systems, maritime, manufacturing, construction, government, information technology, and education.
• Regions: Continental United States and US territories, notably Guam (a strategic Indo-Pacific military hub). Activity also observed against partners in the Five Eyes. The August 2024 Versa Director campaign hit US-based ISPs, MSPs, and IT-sector organizations and at least one non-US victim.
• Victim profile: Organizations whose disruption would have outsized strategic/military impact, plus the ISPs/MSPs/edge-device fleets that provide stealthy infrastructure and downstream reach. The group also targets the personal email of key network and IT staff to aid intrusion.

Notable campaigns

• Mid-2021 onward — Initial critical-infrastructure intrusions. Volt Typhoon begins long-dwell operations against US critical infrastructure, including in Guam. (Microsoft, 2023-05-24)
• 2023-05-24 — Public exposure ("Volt Typhoon"). Microsoft and a Five Eyes joint advisory detail LOTL tradecraft, initial access via internet-facing Fortinet FortiGuard devices, and C2 proxying through compromised SOHO routers (ASUS, Cisco, D-Link, NETGEAR, Zyxel). (Microsoft Security Blog)
• 2023-12 — KV Botnet disclosure. Lumen's Black Lotus Labs publicly discloses the KV Botnet, a covert network of compromised end-of-life Cisco and NETGEAR SOHO routers used to anonymize and proxy Volt Typhoon operations. (Lumen / Black Lotus Labs)
• 2024-01-31 — DOJ/FBI court-authorized takedown. The US announces a December 2023 court-authorized operation that remotely removed KV Botnet malware from hundreds of US-based SOHO routers and severed their C2. (US DOJ)
• 2024-02-07 — CISA AA24-038A. CISA, NSA, FBI and international partners publish "PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure," reporting persistence of up to ~five years in some victim networks and explicit OT pre-positioning concerns, alongside supplemental LOTL hunting guidance. (CISA)
• 2024-08-27 — Versa Director zero-day (CVE-2024-39717). Black Lotus Labs attributes (moderate confidence) exploitation of a Versa Director SD-WAN management zero-day, beginning around 2024-06-12, deploying the bespoke in-memory VersaMem Java web shell to harvest plaintext credentials at ISPs/MSPs/IT firms. (Lumen / Black Lotus Labs)

TTPs by ATT&CK tactic

Reconnaissance

• T1590 / T1590.004 / T1590.006 — Extensive pre-compromise gathering of victim network info, network topology, and network security appliances.
• T1591 / T1591.004 — Org reconnaissance; identifies key network/IT staff roles.
• T1589 / T1589.002 — Gathers identity info including personal email addresses of network/IT personnel.
• T1592 — Host reconnaissance prior to compromise.
• T1593 / T1594 — Searches open websites/domains and victim-owned sites.
• T1596.005 — Uses scan databases (Shodan, Censys, FOFA) to find exposed infrastructure.

Resource Development

• T1583.003 / T1584.003 / T1584.004 / T1584.005 / T1584.008 — Acquires VPS and compromises VPS, servers (e.g., PRTG), botnets (KV Botnet), and network edge devices in victim geographies for C2.
• T1587.001 / T1587.004 — Develops the VersaMem web shell variant and zero-day exploits.
• T1588.002 / T1588.006 — Obtains legitimate/forensic tooling and publicly available exploit code.

Initial Access

• T1190 — Exploits public-facing applications: Fortinet FortiGuard, Ivanti, Citrix, Cisco, NETGEAR, and Versa Director (CVE-2024-39717).
• T1133 — Uses external remote services / VPNs to connect and run post-exploitation actions.
• T1078 / T1078.002 — Relies primarily on valid (often domain) accounts for access and persistence.

Execution

• T1059.001 / T1059.003 / T1059.004 — PowerShell, Windows cmd, and Unix/Bash shells for discovery and hands-on-keyboard ops (KV Botnet uses Bash).
• T1047 — WMI/WMIC for execution, discovery, and creating temp directories.
• T1218 — Native LOLBins to expand access.

Persistence

• T1505.003 — Web shells (e.g., AuditReport.jspx, iisstart.aspx, Awen, and VersaMem on Versa Director).
• T1078 / T1078.002 — Stolen valid/domain credentials are the primary persistence mechanism (no implant needed).

Privilege Escalation

• T1068 — Exploits OS and network-service vulnerabilities for escalation.
• T1078.002 — Reuses harvested domain admin credentials to operate at elevated privilege.

Defense Evasion

• T1070.001 / T1070.004 / T1070.007 — Selectively clears Windows event logs, deletes working directories (rd /S), and scrubs IP addresses from server logs.
• T1027.002 — UPX-packs tools (BrightmetricAgent.exe, ScanLine).
• T1036.004 / T1036.005 / T1036.008 — Masquerades process/service names (KV Botnet renames to [kworker/0:1]), uses legitimate-looking filenames (cisco_up.exe, Win.exe), and appends .gif to exfil archives of ntds.dit.
• T1112 — netsh PortProxy registry modification.
• T1497.001 — System checks to detect virtualized/sandbox environments.
• T1140 — Base64 decode and deobfuscation (incl. via certutil).

Credential Access

• T1003.001 — Attempts LSASS memory access for hashed credentials.
• T1003.003 — Uses ntdsutil to create domain controller install media containing the NTDS database; dumps ntds.dit.
• T1555 / T1555.003 — Targets password stores (OpenSSH, RealVNC, PuTTY) and browser-stored credentials of network admins.
• T1552 / T1552.004 — Harvests credentials from network appliances and private keys (Chrome Local State AES key).
• T1556 — Hooks Versa's authentication routine via VersaMem to capture plaintext credentials.

Discovery

• T1087.001 / T1087.002 — net user, quser, net group /dom for local and domain account discovery.
• T1069.001 / T1069.002 — net localgroup administrators, net group for local/domain groups.
• T1016 — ipconfig, netsh interface firewall, netsh interface portproxy.
• T1049 — netstat -ano.
• T1018 / T1046 — Remote system discovery (Ping) and network service discovery via commercial + LOTL tools.
• T1057 — Process enumeration (KV Botnet flags security processes).
• T1518.001 — Security-software discovery.
• T1654 — Log enumeration via wevtutil.exe and PowerShell Get-EventLog.

Lateral Movement

• T1021.001 — RDP to domain controllers with compromised credentials.
• T1570 — Copies web shells between servers.

Collection

• T1005 — Steals files from sensitive servers, Active Directory, and event logs.
• T1560.001 — Archives ntds.dit into multi-volume password-protected 7-Zip archives.
• T1074.001 — Stages ntds.dit, SYSTEM, and SECURITY hives in C:\Windows\Temp\.
• T1056.001 — Keylogging (rult3uil.log on domain controllers).
• T1113 — Screen capture via gdi32.dll/gdiplus.dll.

Command and Control

• T1090 / T1090.001 / T1090.003 — Proxying through compromised SOHO devices; internal netsh port proxy; multi-hop proxy chains. Customized FRP, Earthworm, and Impacket.
• T1071.001 / T1573.001 / T1573.002 — HTTPS web-protocol C2 (Versa) on 443; AES-encrypted Awen web shell; asymmetric/symmetric encrypted channels.
• T1095 / T1571 — Non-application-layer / custom protocols; KV Botnet random high port (>30000).
• T1105 — Ingress tool transfer (e.g., downloads outdated comsvcs.dll).

Exfiltration

• Exfiltration occurs over the encrypted proxied C2 channel (T1090 / T1071.001 / T1573.002), moving the password-protected, often .gif-renamed archives (T1560.001 / T1036.008) staged on the host. The group avoids large-volume exfil to stay quiet, consistent with its access-maintenance objective.

Impact

• No destructive impact has been publicly confirmed in victim networks; the documented activity is pre-positioning for potential future disruptive/destructive attacks against OT per CISA AA24-038A. Emulation should model the access path and dwell, not actual destruction.

Signature tooling & malware

• VersaMem (S1154) — Custom in-memory Java web shell; injects into the Apache Tomcat process via the Java Instrumentation API + Javassist to hook authentication and steal plaintext credentials. Custom.
• KV Botnet — Custom Linux malware running on compromised EOL Cisco/NETGEAR SOHO routers; renames to [kworker/0:1], uses random high ports, bind-mounts to /proc/, and proxies/anonymizes operator traffic. Custom.
• FRP / Fast Reverse Proxy (S1144), Earthworm, Impacket (S0357) — Customized open-source proxy/tunneling and lateral-movement frameworks.
• Mimikatz (S0002) — Credential dumping (LSASS).
• Living-off-the-land binaries: cmd (S0106), certutil (S0160), netsh (S0108), Net (S0039), netstat (S0104), Nltest (S0359), Ping (S0097), PsExec (S0029), Reg (S0075), Systeminfo (S0096), Tasklist (S0057), Wevtutil (S0645), ipconfig (S0100), plus ntdsutil, wmic, vssadmin, wevtutil. Web shells observed: Awen, AuditReport.jspx, iisstart.aspx. Recon/post-ex: ScanLine, BrightmetricAgent (UPX-packed).

Emulation guidance (Decepticon)

Authorized use only. Execute these TTPs solely within the documented scope and rules of engagement of an explicitly authorized red-team engagement. Do not target out-of-scope systems, real critical-infrastructure OT, or third-party edge devices, and never stage destructive actions — Volt Typhoon's value to emulate is its stealth and dwell, not impact.

Map Volt Typhoon's signature to Decepticon capabilities:

• Initial access (T1190 / T1133): Use Decepticon's exploitation/recon tooling to identify and exploit in-scope internet-facing appliances (VPN/SD-WAN/edge). Mirror the edge-device-first pattern. Capture device-stored AD service-account credentials and pivot inward with valid accounts (T1078) instead of dropping implants.
• LOTL execution (T1059.x / T1047 / T1218): Drive everything through the bash skill and native Windows binaries — wmic, powershell, cmd, netsh. Forbid yourself from uploading EXEs where a LOLBin works. This is the defining behavior to reproduce.
• AD / credential access (T1003.003 / T1003.001 / T1555): Use the AD skills to emulate ntdsutil/ntds.dit capture and LSASS access; stage hives in C:\Windows\Temp\, 7-Zip into password-protected multi-volume archives, and rename with a .gif extension to mirror T1560.001 / T1074.001 / T1036.008.
• Persistence via web shells (T1505.003): Use the defense-evasion / payload skills to plant a minimal web shell on an in-scope server, mimicking VersaMem's auth-hook credential capture rather than a noisy beacon.
• C2 & proxying (T1090 / T1071.001 / T1573.x): Configure Sliver (c2) for HTTPS on 443 through an in-scope multi-hop proxy chain to emulate the SOHO-router relay pattern; route via the lateral-movement skill with netsh portproxy for internal pivots (T1090.001 / T1112).
• Lateral movement (T1021.001 / T1570): Use harvested domain creds for RDP to a DC and copy the web shell between hosts via the lateral-movement skill.
• Defense evasion (T1070.x / T1497.001): Selectively clear engagement-relevant event logs (with blue-cell coordination/snapshots), run sandbox checks, and masquerade tool/process names to test the SOC's LOTL-detection maturity.
• Cloud skills: If the in-scope environment is hybrid, emulate harvesting cloud/identity creds and pivoting to cloud-hosted management planes consistent with the actor's identity-centric tradecraft.
• Discovery (T1087/T1069/T1016/T1049/T1018): Run the exact native commands (net user, net group /dom, net localgroup administrators, ipconfig, netstat -ano, ) so blue can validate baseline detections.

Pace operations slowly and quietly to exercise long-dwell detection rather than tripping volume-based alerts.

Detection & defense

• Hunt LOTL command lines: Alert on anomalous wmic, ntdsutil/ntdsutil.exe create, vssadmin create shadow, netsh interface portproxy add, reg save HKLM\SYSTEM|SECURITY, wevtutil cl, and net group /domain issued by non-admin or service contexts (T1059, T1003.003, T1112, T1070.001). Follow CISA AA24-038A's supplemental LOTL guidance.
• NTDS/credential theft (T1003.003 / T1560.001): Monitor for ntds.dit copies outside DCs, 7-Zip multi-volume archives, and files with mismatched extensions (e.g., .gif that are actually archives) in C:\Windows\Temp\.
• PortProxy / proxying (T1090.001 / T1112): Detect HKLM\...\PortProxy\v4tov4 registry writes and unexpected netsh portproxy listeners; baseline egress to identify SOHO/edge relays and multi-hop proxy chains.
• Edge & SOHO device hygiene (T1190 / T1584.005): Patch/replace EOL routers (Cisco, NETGEAR), restrict management-interface exposure, and patch Fortinet/Ivanti/Citrix/Versa (notably CVE-2024-39717 — upgrade Versa Director ≥ 22.1.4). Restrict outbound from edge devices.
• Web shells (T1505.003): Monitor web-server directories for new .jspx/.aspx files and unusual Tomcat/IIS child processes; for Versa, hunt in-memory Java agents hooking authentication and inspect /var/versa upload paths.
• Credential & identity controls (T1078 / T1556): Enforce phishing-resistant MFA, segment and tier admin accounts, rotate appliance/service-account credentials, and disable credential storage in browsers/PuTTY for admin workstations. Alert on RDP to DCs from atypical hosts (T1021.001).
• Log integrity (T1070): Forward logs off-host in real time so selective clearing on the endpoint does not erase evidence; alert on Security log clears (Event ID 1102) and Sysmon process-creation gaps.
• OT segmentation: Strictly segment IT from OT, monitor IT-to-OT pivot paths, and treat any IT foothold near OT as a pre-positioning indicator consistent with this actor's intent.

Sources

• MITRE ATT&CK — Volt Typhoon (G1017): https://attack.mitre.org/groups/G1017/
• Microsoft Security Blog — "Volt Typhoon targets US critical infrastructure with living-off-the-land techniques" (2023-05-24): https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/
• CISA AA24-038A — "PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure" (2024-02-07): https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-038a
• Lumen Black Lotus Labs — Versa Director zero-day (CVE-2024-39717) / VersaMem (2024-08-27): https://blog.lumen.com/uncovering-the-versa-director-zero-day-exploitation/
• US DOJ / FBI — KV Botnet court-authorized takedown reporting (2024-01-31): https://www.securityweek.com/us-gov-disrupts-soho-router-botnet-used-by-chinese-apt-volt-typhoon/