MITRE ATT&CKgroup

G1017 Volt Typhoon

Published 2023-07-27 Modified 2026-07-31 Official page ↗
Domain
enterprise
Aliases
BRONZE SILHOUETTE, Vanguard Panda, DEV-0391, UNC3236, Voltzite, Insidious Taurus, DazedToad
Version
2.0
Created
2023-07-27

Description

Volt Typhoon is a People's Republic of China (PRC) state-sponsored actor that has been active since at least 2021, primarily targeting critical infrastructure organizations in the US and its territories including Guam. Volt Typhoon's targeting and pattern of behavior have been assessed as pre-positioning to enable lateral movement to operational technology (OT) assets for potential destructive or disruptive attacks. Volt Typhoon has emphasized stealth in operations using web shells, living-off-the-land (LOTL) binaries, hands on keyboard activities, and stolen credentials.. The group has leveraged compromised SOHO routers to proxy command and control traffic and obscure its infrastructure, activity associated with the KV botnet.. Reporting indicates a separate initial access cluster, SYLVANITE, has been observed exploiting internet-facing edge devices and transferring access to Volt Typhoon, also tracked as VOLTZITE, for follow-on operations.

Related

Uses · MITRE ATT&CK (98)

  • T1685.005 Clear Windows Event Logs sub-technique
  • T1680 Local Storage Discovery technique
  • S1154 VersaMem software (malware)
  • S1144 FRP software (tool)
  • T1584.008 Network Devices sub-technique
  • T1654 Log Enumeration technique
  • T1036.008 Masquerade File Type sub-technique
  • T1070.007 Clear Network Connection History and Configurations sub-technique
  • S0645 Wevtutil software (tool)
  • T1614 System Location Discovery technique
  • T1016.001 Internet Connection Discovery sub-technique
  • T1588.006 Vulnerabilities sub-technique
  • T1589 Gather Victim Identity Information technique
  • T1589.002 Email Addresses sub-technique
  • T1590 Gather Victim Network Information technique
  • T1590.004 Network Topology sub-technique
  • T1590.006 Network Security Appliances sub-technique
  • T1591 Gather Victim Org Information technique
  • T1591.004 Identify Roles sub-technique
  • T1592 Gather Victim Host Information technique
  • T1593 Search Open Websites/Domains technique
  • T1594 Search Victim-Owned Websites technique
  • T1596.005 Scan Databases sub-technique
  • T1584.003 Virtual Private Server sub-technique
  • T1584.004 Server sub-technique
  • T1584.005 Botnet sub-technique
  • T1587.004 Exploits sub-technique
  • T1588.002 Tool sub-technique
  • T1573.001 Symmetric Cryptography sub-technique
  • T1090.001 Internal Proxy sub-technique
Show all 98 ›

Referenced by MITRE ATT&CK · attributed to (2)

  • C0039 Versa Director Zero Day Exploitation campaign
  • C0035 KV Botnet Activity campaign

References