Volt Typhoon: threat actor profile

Volt Typhoon is a People's Republic of China (PRC) state-sponsored actor that has been active since at least 2021, primarily targeting critical infrastructure organizations in the US and its territories including Guam. (MITRE ATT&CK, G1017)

Also known as: BRONZE SILHOUETTE, Vanguard Panda, DEV-0391, UNC3236, Voltzite, Insidious Taurus, DazedToad

Techniques in the attacks we reported

From official sources on attacks attributed to this group alone.

1. Execution Hijack Execution Flow: Dynamic Linker Hijacking T1574.006 · Command and Scripting Interpreter: Unix Shell T1059.004
2. Persistence Boot or Logon Initialization Scripts T1037 · Create or Modify System Process T1543
3. Privilege Escalation Process Injection: Ptrace System Calls T1055.008 · Boot or Logon Initialization Scripts T1037 · Create or Modify System Process T1543
4. Stealth Process Injection: Ptrace System Calls T1055.008 · Hijack Execution Flow: Dynamic Linker Hijacking T1574.006 · Masquerading: Masquerade Task or Service T1036.004 · Obfuscated Files or Information: Software Packing T1027.002 · Virtualization/Sandbox Evasion: System Checks T1497.001 · Indicator Removal: Timestomp T1070.006
5. Credential Access Network Sniffing T1040
6. Discovery Virtualization/Sandbox Evasion: System Checks T1497.001 · Network Sniffing T1040
7. Command and Control Encrypted Channel: Symmetric Cryptography T1573.001

Attacks we reported

1. Oct 29, 2026 Cisco Talos Exposes KeyDrift Malware Targeting SD-WAN

81 techniques MITRE has documented for this group

1. Reconnaissance Gather Victim Identity Information T1589 · Gather Victim Identity Information: Email Addresses T1589.002 · Gather Victim Network Information T1590 · Gather Victim Network Information: Network Topology T1590.004 · Gather Victim Network Information: Network Security Appliances T1590.006 · Gather Victim Org Information T1591 · Gather Victim Org Information: Identify Roles T1591.004 · Gather Victim Host Information T1592 · Search Open Websites/Domains T1593 · Search Victim-Owned Websites T1594 · Search Open Technical Databases: Scan Databases T1596.005
2. Resource Development Compromise Infrastructure: Virtual Private Server T1584.003 · Compromise Infrastructure: Server T1584.004 · Compromise Infrastructure: Botnet T1584.005 · Compromise Infrastructure: Network Devices T1584.008 · Develop Capabilities: Exploits T1587.004 · Obtain Capabilities: Tool T1588.002 · Obtain Capabilities: Vulnerabilities T1588.006
3. Initial Access Valid Accounts T1078 · Valid Accounts: Domain Accounts T1078.002 · External Remote Services T1133 · Exploit Public-Facing Application T1190
4. Execution Windows Management Instrumentation T1047 · Command and Scripting Interpreter: PowerShell T1059.001 · Command and Scripting Interpreter: Windows Command Shell T1059.003 · Command and Scripting Interpreter: Unix Shell T1059.004
5. Persistence Valid Accounts T1078 · Valid Accounts: Domain Accounts T1078.002 · Modify Registry T1112 · External Remote Services T1133 · Server Software Component: Web Shell T1505.003
6. Privilege Escalation Exploitation for Privilege Escalation T1068 · Valid Accounts T1078 · Valid Accounts: Domain Accounts T1078.002
7. Stealth Direct Volume Access T1006 · Obfuscated Files or Information: Software Packing T1027.002 · Masquerading: Match Legitimate Resource Name or Location T1036.005 · Masquerading: Masquerade File Type T1036.008 · Indicator Removal: File Deletion T1070.004 · Indicator Removal: Clear Network Connection History and Configurations T1070.007 · Valid Accounts T1078 · Valid Accounts: Domain Accounts T1078.002 · Deobfuscate/Decode Files or Information T1140 · System Binary Proxy Execution T1218 · Virtualization/Sandbox Evasion: System Checks T1497.001
8. Defense Impairment Modify Registry T1112 · Disable or Modify Tools: Clear Windows Event Logs T1685.005
9. Credential Access OS Credential Dumping: LSASS Memory T1003.001 · OS Credential Dumping: NTDS T1003.003 · Input Capture: Keylogging T1056.001 · Unsecured Credentials T1552 · Unsecured Credentials: Private Keys T1552.004 · Credentials from Password Stores T1555 · Credentials from Password Stores: Credentials from Web Browsers T1555.003
10. Discovery System Service Discovery T1007 · Application Window Discovery T1010 · Query Registry T1012 · System Network Configuration Discovery T1016 · System Network Configuration Discovery: Internet Connection Discovery T1016.001 · Remote System Discovery T1018 · System Owner/User Discovery T1033 · Network Service Discovery T1046 · System Network Connections Discovery T1049 · Process Discovery T1057 · Permission Groups Discovery T1069 · Permission Groups Discovery: Local Groups T1069.001 · Permission Groups Discovery: Domain Groups T1069.002 · File and Directory Discovery T1083 · Account Discovery: Local Account T1087.001 · Account Discovery: Domain Account T1087.002 · Peripheral Device Discovery T1120 · System Time Discovery T1124 · Browser Information Discovery T1217 · Virtualization/Sandbox Evasion: System Checks T1497.001 · Software Discovery T1518 · System Location Discovery T1614 · Log Enumeration T1654 · Local Storage Discovery T1680
11. Lateral Movement Remote Services: Remote Desktop Protocol T1021.001 · Lateral Tool Transfer T1570
12. Collection Data from Local System T1005 · Input Capture: Keylogging T1056.001 · Data Staged T1074 · Data Staged: Local Data Staging T1074.001 · Screen Capture T1113 · Archive Collected Data: Archive via Utility T1560.001
13. Command and Control Proxy T1090 · Proxy: Internal Proxy T1090.001 · Proxy: Multi-hop Proxy T1090.003 · Ingress Tool Transfer T1105 · Encrypted Channel: Symmetric Cryptography T1573.001

All threat actors · ATT&CK heatmap

MITRE ATT&CK® data © The MITRE Corporation, reproduced and distributed with the permission of The MITRE Corporation (Enterprise ATT&CK v20.0).