Volt Typhoon: Silent Presence — China's Pre-Positioning Campaign in Western Critical Infrastructure Using Living-off-the-Land Techniques and Stealth Persistence

The group that hides in plain sight.

Volt Typhoon — also tracked as Vanguard Panda, Bronze Silhouette, DEV-0391, Insidious Taurus, and UNC3236 — is a Chinese state-sponsored threat group that has been conducting cyber operations against Western critical infrastructure since at least 2021, with evidence suggesting activity potentially stretching back to mid-2020 or earlier. What makes Volt Typhoon singular in the threat landscape is not the sophistication of their custom tooling — because they deploy almost none — but rather the discipline of their operational methodology. Volt Typhoon has built and maintained persistent access to critical infrastructure networks across the United States, including energy utilities, water treatment facilities, telecommunications providers, transportation systems, and military-adjacent installations, using almost exclusively the tools and features that are already present on the victim systems they compromise. This living-off-the-land approach represents a fundamental challenge to defenders: the adversary's actions are virtually indistinguishable from the daily activities of legitimate system administrators.

The group first entered public consciousness on 24 May 2023, when Microsoft published a detailed threat intelligence report attributing a campaign targeting US critical infrastructure organisations in Guam and elsewhere to a state-sponsored actor based in China. The disclosure was coordinated with the US National Security Agency (NSA), the Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), and the intelligence agencies of the Five Eyes alliance — Australia, Canada, New Zealand, and the United Kingdom. The joint advisory was extraordinary in its breadth and urgency: five nations publicly attributing an active, ongoing campaign designed not to steal data, but to pre-position for potential disruption of critical services during a future geopolitical crisis. The subtext was unmistakable — this was preparation for a potential military conflict over Taiwan, and the battlefield extended to American water supplies, power grids, and communications networks.

What distinguishes Volt Typhoon from virtually every other documented advanced persistent threat group is the apparent objective of their operations. Traditional cyber espionage groups — including China's own APT41, APT10, and APT40 — seek to exfiltrate data: intellectual property, diplomatic communications, military plans, personal information. Volt Typhoon shows minimal interest in data theft. Instead, their operational pattern is consistent with what military planners call operational preparation of the environment (OPE) — establishing access to systems whose disruption would degrade an adversary's ability to project military power, sustain civilian morale, and maintain economic stability during a conflict. The targets — power generation, water treatment, port operations, telecommunications switching centres — are precisely those whose failure would have cascading effects on both military logistics and civilian life. Volt Typhoon is not collecting intelligence; they are building a capability to cause real-world harm at a time of their choosing.

Linking Volt Typhoon to the People's Republic of China.

Critical infrastructure as the battlespace.

Volt Typhoon's targeting is narrower than many Chinese APT groups but far more strategically focused. Rather than casting a wide net across industries for intellectual property, Volt Typhoon exclusively targets sectors whose disruption would have immediate, cascading consequences on national security, military operations, and civilian welfare. Every confirmed target aligns with a military planning objective: degrade the adversary's ability to deploy forces, communicate, sustain energy supplies, and maintain public order. The geographic focus is overwhelmingly the continental United States and US Pacific territories — particularly Guam, which serves as a critical staging point for US military operations in the Indo-Pacific theatre. Secondary targeting has been reported against critical infrastructure in Australia, Canada, and the United Kingdom, all Five Eyes alliance members with mutual defence obligations.

Living off the land — invisible by design.

Volt Typhoon's defining characteristic is their near-total reliance on living-off-the-land binaries and scripts (LOLBins/LOLBas) — legitimate tools, commands, and features that are pre-installed on every Windows and network device operating system. Where most advanced persistent threat groups develop custom malware that provides unique capabilities but also creates unique detection signatures, Volt Typhoon has made the strategic decision to forgo custom tooling almost entirely. Their operators use the same commands that system administrators use every day: wmic for system queries, ntdsutil for Active Directory database extraction, netsh for network configuration and port forwarding, PowerShell for automation and remote execution, certutil for file transfers, and cmd.exe for general command execution. The result is an adversary whose forensic footprint is functionally identical to normal administrative activity.

This approach imposes significant constraints on the operator — LOLBins lack the flexibility, automation, and resilience of purpose-built implants — but it confers an enormous defensive advantage: there is no malware to detect. No custom binary to signature. No novel network protocol to flag. No suspicious file hash to blocklist. Every tool Volt Typhoon uses is a legitimate, Microsoft-signed, pre-installed operating system component that cannot be removed or blocked without breaking normal system functionality. Traditional indicator-of-compromise (IOC) based detection — the foundation of most security operations — is rendered almost entirely ineffective. Detection must instead be based on behavioural analysis: understanding not what tool is being run, but the context, sequence, timing, and parameters of its execution. This is orders of magnitude more difficult than pattern-matching against known malicious artifacts.

The operational security extends beyond tool selection to every aspect of tradecraft. Volt Typhoon routes their traffic through compromised small office/home office (SOHO) routers and VPN appliances — devices manufactured by NETGEAR, Cisco, Fortinet, Zyxel, and others — creating a network of operational relay boxes (ORBs) that make their command-and-control traffic appear to originate from residential and small business IP addresses within the victim's own geographic region. This geographically proximate routing defeats a common detection heuristic — flagging connections from unusual or foreign IP ranges. When a US power utility sees a connection from a residential IP address in the same state, it does not trigger the same alarms as a connection from a known hostile IP range in East Asia. The compromised SOHO devices, collectively managed through what researchers have termed the KV Botnet, provide a disposable, rotating, and geographically distributed C2 infrastructure that is exceptionally difficult to disrupt or track.

No malware required — your own tools weaponised.

Through the edge — where patching fails.

From silent intrusion to national security crisis.

Volt Typhoon's campaign history does not follow the pattern of most documented threat groups — there are no headline-grabbing data breaches, no ransomware deployments, no leaked databases appearing on dark web forums. Instead, the history is one of quiet accumulation: methodical, patient, and deeply alarming in its implications. The group's operations came to public attention not because they were detected through traditional security monitoring, but because the United States Intelligence Community, working with Microsoft and international partners, pieced together a pattern of intrusions across disparate critical infrastructure networks that, viewed individually, appeared to be routine compromises but, viewed collectively, revealed a coordinated strategic campaign of unprecedented scope. The fact that Volt Typhoon had operated undetected for at least two years before the May 2023 disclosure — and potentially longer — underscores the effectiveness of their living-off-the-land methodology.

The May 2023 Microsoft and Five Eyes Disclosure was the moment Volt Typhoon became a household name in cybersecurity. On 24 May 2023, Microsoft published a detailed threat intelligence blog post titled 'Volt Typhoon targets US critical infrastructure with living-off-the-land techniques,' attributing a sustained campaign against critical infrastructure organisations in Guam and elsewhere in the United States to a Chinese state-sponsored actor. The same day, CISA, NSA, FBI, and the intelligence agencies of Australia, Canada, New Zealand, and the United Kingdom released a joint cybersecurity advisory (CSA) providing technical indicators, detection guidance, and mitigation recommendations. The coordinated disclosure across five nations was itself significant — it signalled that the intelligence community viewed Volt Typhoon not as a routine espionage operation but as a strategic threat requiring an unprecedented level of international coordination. The advisory specifically highlighted the group's targeting of communications, manufacturing, utility, transportation, construction, maritime, government, information technology, and education sectors, with particular emphasis on organisations in Guam.

In February 2024, CISA, NSA, and FBI released a follow-up advisory — 'PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure' — that significantly escalated the urgency of the Volt Typhoon threat assessment. This advisory revealed that Volt Typhoon had maintained persistent access to some victim networks for at least five years, dating back to at least 2019 in some cases. The advisory confirmed compromises across the communications, energy, transportation systems, and water and wastewater systems sectors. CISA Director Jen Easterly stated publicly that 'the PRC cyber threat is not theoretical' and described Volt Typhoon's activity as 'the tip of the iceberg.' FBI Director Christopher Wray testified before Congress that China's hackers were 'positioning on American infrastructure in preparation to wreak havoc and cause real-world harm to American citizens and communities' and characterised the scale of the Chinese hacking programme as being 'on a scale greater than we'd seen before — larger than the combined cyber programmes of every other major nation combined.'

The KV Botnet Disruption (January 2024) represented the first major offensive action against Volt Typhoon's infrastructure. The FBI, acting under court authorisation, conducted a remote operation to disrupt the KV Botnet — Volt Typhoon's network of compromised SOHO routers used as operational relay boxes for C2 communications. The operation remotely removed malware from hundreds of compromised Cisco and NETGEAR routers across the United States, severing a critical component of Volt Typhoon's command-and-control infrastructure. However, security researchers cautioned that the disruption was likely temporary — many of the compromised devices remained vulnerable to re-exploitation (running end-of-life firmware with no available patches), and Volt Typhoon had demonstrated the ability to rapidly rebuild compromised infrastructure. The operation did, however, provide valuable intelligence on the botnet's architecture and the scope of the compromise.

Throughout 2024 and into 2025, additional disclosures revealed the full scope of Volt Typhoon's penetration. Reports emerged of compromises affecting water utilities in Hawaii, a power grid operator on the West Coast, oil and natural gas pipeline companies, and port facilities critical to military logistics. Security researchers at Lumen Technologies' Black Lotus Labs published detailed analysis of the KV Botnet's multiple clusters — KV, JDY, and a third cluster of higher-capability devices used for manual operator interaction — revealing a sophisticated, layered infrastructure designed for resilience. The JDY cluster alone encompassed approximately 1,500 compromised devices at its peak. Simultaneously, the PRC government launched a counter-narrative campaign, with China's National Computer Virus Emergency Response Centre and the National Engineering Laboratory for Computer Virus Prevention Technology publishing reports alleging that Volt Typhoon was fabricated by US intelligence agencies and cybersecurity companies as part of a 'political farce' — claims that were widely dismissed by the international security community but that highlighted the geopolitical sensitivity of the attribution.

The Guam targeting deserves specific attention because of its strategic significance. Guam, a US territory in the Western Pacific, hosts Andersen Air Force Base — home to long-range bomber and tanker aircraft critical to US force projection in the Indo-Pacific — and Naval Base Guam, a forward-deployed submarine and surface ship base. In any conflict scenario involving Taiwan, Guam would serve as a critical logistics hub, staging area, and command centre for US military operations. Volt Typhoon's documented targeting of critical infrastructure in Guam — including telecommunications, power, water, and transportation systems — aligns precisely with a military planning objective to degrade the supporting infrastructure that enables Andersen and Naval Base Guam to operate effectively. Disrupting Guam's civilian infrastructure would simultaneously impair military operations that depend on the same power grid, water supply, and telecommunications networks. This dual-use dependency is precisely what makes Volt Typhoon's pre-positioning so strategically potent.

Finding the needle that looks like hay.

Defending against Volt Typhoon is arguably the hardest detection problem in modern cybersecurity. The group's living-off-the-land approach eliminates the traditional detection advantage that defenders have relied on for decades — the ability to identify adversary activity through malware signatures, suspicious binaries, and anomalous network protocols. When the adversary uses the same tools as your administrators, detection becomes a problem of context rather than content. You cannot block wmic.exe, PowerShell, or netsh.exe — they are essential operating system components. You must instead develop the capability to distinguish between a legitimate administrator running ntdsutil for a routine Active Directory backup and a Volt Typhoon operator running the same command for credential theft. This requires a fundamentally different defensive posture — one centred on behavioural baselining, anomaly detection, and proactive threat hunting rather than signature-based prevention.

Volt Typhoon within China's cyber strategy evolution.

Volt Typhoon represents a fundamental evolution in China's cyber operations strategy — a shift from the intelligence collection and economic espionage that characterised the first two decades of Chinese cyber operations toward operational preparation of the environment (OPE) for potential kinetic conflict. For years, Chinese cyber groups — APT1 through the PLA, APT10, APT40, and APT41 through the MSS — focused on stealing intellectual property, conducting surveillance, and gathering diplomatic and military intelligence. Volt Typhoon is doing something categorically different: they are building a war-fighting capability. The transition is consistent with broader PRC military doctrine on 'informatised warfare' and the PLA's concept of 'systems destruction warfare' — the idea that degrading an adversary's information and infrastructure systems can achieve strategic effects equivalent to kinetic military operations. Volt Typhoon is, in essence, the cyber component of China's preparation for a potential conflict over Taiwan, with US critical infrastructure as the target.

The emergence of Volt Typhoon has forced a fundamental reassessment of the Chinese cyber threat. For two decades, the Western cybersecurity community conceptualised Chinese cyber operations primarily as an espionage and intellectual property theft problem — damaging to economic competitiveness and national security, but not an immediate threat to physical safety or critical services. Volt Typhoon shattered that framework. The group's focus on pre-positioning in infrastructure whose disruption would cause real-world harm to civilian populations — loss of power, loss of water treatment, loss of communications, disruption of transportation — represents a qualitative escalation in the threat. The analogy is not to a spy stealing secrets but to a saboteur planting charges on a bridge: the damage has not occurred yet, but the capability to cause it has been established and is being maintained. This shift from espionage to operational preparation is the most significant development in the Chinese cyber threat landscape since Mandiant's 2013 APT1 report first exposed the scale of PRC state-sponsored hacking.

The bottom line.

Volt Typhoon is unlike any threat group that has come before it — not because of the sophistication of their malware (they barely use any), not because of the novelty of their exploits (they exploit known vulnerabilities), and not because of the scale of their data theft (they steal almost nothing). Volt Typhoon is unique because of their intent. They are building and maintaining the capability to disrupt critical infrastructure services — power, water, communications, transportation — across the United States and its Pacific territories, at a time of their choosing, in support of potential PRC military operations. Every compromised water utility, every persistent foothold in an energy company, every backdoored telecommunications switch is a pre-positioned capability waiting to be activated. The living-off-the-land methodology is not a limitation — it is a deliberate strategic choice that maximises the probability of remaining undetected for the years or decades that may elapse between initial compromise and operational activation.

The challenge Volt Typhoon poses to defenders is existential in a way that traditional cyber threats are not. Ransomware demands a payment; espionage steals data; hacktivism defaces websites. These are damaging but bounded events with understood consequences. Volt Typhoon represents the possibility of a coordinated, multi-sector infrastructure disruption during a geopolitical crisis — loss of power to military installations and surrounding communities, disruption of water treatment affecting public health, severed communications hampering emergency response, paralysed transportation impeding military logistics. The CISA and FBI directors have used language — 'the defining threat of our generation,' 'preparation to wreak havoc and cause real-world harm' — that is extraordinary for senior government officials and reflects the gravity with which the US national security establishment views this threat. The response requires not just better detection tools but a fundamental rethinking of how critical infrastructure networks are architected, segmented, monitored, and defended.

For critical infrastructure operators, the message is clear and urgent: assume compromise and act accordingly. Implement the enhanced logging, behavioural baselining, and proactive hunting capabilities necessary to detect living-off-the-land activity. Harden the IT/OT boundary to prevent compromise of information technology networks from cascading to operational technology systems. Replace end-of-life network equipment that cannot be patched and provides a foothold for ORB networks. Invest in identity security and privileged access management to deny adversaries the credential abuse that Volt Typhoon depends on. And do all of this with the understanding that the threat is not hypothetical — CISA has confirmed that Volt Typhoon has been inside US critical infrastructure networks for years, and their access has been used to map network topologies, identify OT system boundaries, and position for disruption. The charges are already planted. The question is whether defenders can find and defuse them before they are detonated.