{
  "name": "Adversary Atlas API",
  "version": "1.0.0",
  "description": "Read-only JSON API over the Adversary Atlas threat actor dataset. Statically generated at build time; no authentication, no rate limits.",
  "generated": "2026-07-31T01:06:07.226Z",
  "datasetCurrentAsOf": "2025-09-01",
  "license": "Data compiled from public primary sources; see /methodology/ for sourcing.",
  "actor": {
    "id": "volt-typhoon",
    "slug": "volt-typhoon",
    "name": "Volt Typhoon",
    "shortName": "Volt Typhoon",
    "country": "China",
    "countryCode": "CN",
    "sponsorship": "state-sponsored",
    "status": "active",
    "activeSince": "2021",
    "prominence": 95,
    "mitreGroupId": "G1017",
    "tagline": "Pre-positioning inside U.S. critical infrastructure with no collection payoff — access held for five years for use in a future conflict.",
    "bio": "Volt Typhoon is the clearest public example of cyber pre-positioning, and it broke the analytical model most defenders were using.\n\nEspionage groups steal things. Volt Typhoon largely doesn't. CISA's February 2024 advisory documented the actor maintaining access inside U.S. communications, energy, transportation, and water systems for **at least five years** — with no meaningful data theft. The U.S. government's assessment is unambiguous: the access exists to enable disruptive or destructive effects against critical infrastructure in the event of a major crisis or conflict with the United States.\n\nIts tradecraft is defined by what it does *not* use. Operations run almost entirely on living-off-the-land techniques — wmic, ntdsutil, netsh, PowerShell, and certutil — with essentially no custom malware on victim endpoints. Command and control traverses compromised small-office routers and network devices, chiefly end-of-life Cisco and NETGEAR equipment inside the victim's own geography, so the traffic never crosses a border and never resembles a foreign connection. Credentials come from offline extraction of the NTDS.dit domain database rather than in-memory dumping.\n\nThe result is a threat that produces almost no atomic indicators. There is nothing to blocklist; detection depends on behavioural analysis of legitimate administrative activity.\n\nTargeting choices reinforce the assessment. Guam — the principal U.S. power projection hub in the Western Pacific — has featured prominently. So have water utilities and port operators: organisations with negligible intelligence value and enormous disruption value.\n\nIn January 2024 the FBI executed a court-authorised operation to remotely delete the KV Botnet malware from hundreds of U.S.-based end-of-life SOHO routers that formed the group's covert relay layer.",
    "attribution": {
      "sponsor": "China",
      "service": "People's Republic of China state-sponsored (specific service not publicly designated)",
      "confidence": "high",
      "summary": "Attributed to a People's Republic of China state-sponsored actor in a May 2023 joint advisory from NSA, CISA, FBI, and the cyber security authorities of Australia, Canada, New Zealand, and the United Kingdom, published alongside independent Microsoft reporting. A February 2024 follow-on advisory raised the assessment substantially, stating that the actor is pre-positioning for disruptive effects rather than conducting espionage. No specific PLA or MSS unit has been publicly named, and no individuals have been indicted.",
      "sources": [
        {
          "org": "NSA / CISA / FBI and Five Eyes partners",
          "title": "People's Republic of China State-Sponsored Cyber Actor Living off the Land to Evade Detection",
          "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-144a",
          "date": "2023-05-24"
        },
        {
          "org": "CISA / NSA / FBI and partners",
          "title": "PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure (AA24-038A)",
          "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-038a",
          "date": "2024-02-07"
        },
        {
          "org": "U.S. Department of Justice",
          "title": "U.S. Government Disrupts Botnet People's Republic of China Used to Conceal Hacking of Critical Infrastructure",
          "url": "https://www.justice.gov/opa/pr/us-government-disrupts-botnet-peoples-republic-china-used-conceal-hacking-critical",
          "date": "2024-01-31"
        }
      ]
    },
    "motivations": [
      "pre-positioning",
      "sabotage"
    ],
    "targetSectors": [
      "Critical Infrastructure",
      "ICS / SCADA",
      "Telecommunications",
      "Energy",
      "Water & Wastewater",
      "Transportation",
      "Maritime",
      "Government",
      "Defense",
      "Manufacturing"
    ],
    "targetCountries": [
      "United States",
      "Guam",
      "United Kingdom",
      "Australia",
      "Canada",
      "New Zealand"
    ],
    "aliases": [
      {
        "org": "mitre",
        "name": "Volt Typhoon",
        "url": "https://attack.mitre.org/groups/G1017/",
        "correlation": "exact"
      },
      {
        "org": "microsoft",
        "name": "Volt Typhoon",
        "correlation": "exact"
      },
      {
        "org": "crowdstrike",
        "name": "VANGUARD PANDA",
        "correlation": "exact"
      },
      {
        "org": "mandiant",
        "name": "UNC3236",
        "correlation": "exact"
      },
      {
        "org": "secureworks",
        "name": "BRONZE SILHOUETTE",
        "correlation": "exact"
      },
      {
        "org": "unit42",
        "name": "Insidious Taurus",
        "correlation": "exact"
      },
      {
        "org": "dragos",
        "name": "VOLTZITE",
        "correlation": "exact",
        "note": "Dragos assesses demonstrated interest in OT data, including GIS and network diagrams of electric systems"
      },
      {
        "org": "cisa",
        "name": "Volt Typhoon",
        "correlation": "exact"
      },
      {
        "org": "redcanary",
        "name": "Volt Typhoon",
        "correlation": "exact",
        "note": "Adopts the Microsoft designator"
      }
    ],
    "tools": [
      {
        "name": "wmic",
        "type": "lotl",
        "custom": false,
        "description": "Built-in Windows management interface used for discovery and remote execution — no binary to detect."
      },
      {
        "name": "ntdsutil",
        "type": "lotl",
        "custom": false,
        "description": "Native utility used to create shadow copies of NTDS.dit for offline credential extraction, avoiding LSASS access."
      },
      {
        "name": "netsh",
        "type": "lotl",
        "custom": false,
        "description": "Native networking utility used to configure port proxies for internal pivoting."
      },
      {
        "name": "KV Botnet",
        "type": "malware",
        "custom": true,
        "description": "Covert relay network built from end-of-life Cisco, NETGEAR, and DrayTek SOHO routers inside victim geographies. Disrupted by FBI action in January 2024."
      },
      {
        "name": "Fast Reverse Proxy (frp)",
        "type": "utility",
        "custom": false,
        "description": "Open-source reverse proxy deployed on compromised hosts for persistent tunnelled access."
      },
      {
        "name": "Impacket",
        "type": "lotl",
        "custom": false,
        "description": "Python toolkit used for WMI and SMB remote execution across the victim estate."
      },
      {
        "name": "Earthworm / Awen",
        "type": "utility",
        "custom": false,
        "description": "Public tunnelling and web shell tooling adopted in place of bespoke implants."
      }
    ],
    "techniques": [
      {
        "tCode": "T1190",
        "name": "Exploit Public-Facing Application",
        "tactic": "Initial Access",
        "note": "Fortinet, Citrix, Ivanti, and Zoho ManageEngine appliances at the network edge"
      },
      {
        "tCode": "T1133",
        "name": "External Remote Services",
        "tactic": "Initial Access",
        "note": "Valid VPN credentials harvested from edge devices"
      },
      {
        "tCode": "T1078",
        "name": "Valid Accounts",
        "tactic": "Persistence",
        "note": "Legitimate administrator credentials in place of malware persistence"
      },
      {
        "tCode": "T1059.001",
        "name": "Command and Scripting Interpreter: PowerShell",
        "tactic": "Execution"
      },
      {
        "tCode": "T1003.003",
        "name": "OS Credential Dumping: NTDS",
        "tactic": "Credential Access",
        "note": "Offline extraction via volume shadow copy — never touches LSASS"
      },
      {
        "tCode": "T1090.001",
        "name": "Proxy: Internal Proxy",
        "tactic": "Command and Control",
        "note": "netsh portproxy chains through internal hosts"
      },
      {
        "tCode": "T1584.005",
        "name": "Compromise Infrastructure: Botnet",
        "tactic": "Resource Development",
        "note": "KV Botnet of end-of-life SOHO routers, selected to be in-country relative to victims"
      },
      {
        "tCode": "T1070.001",
        "name": "Indicator Removal: Clear Windows Event Logs",
        "tactic": "Defense Evasion",
        "note": "Selective, targeted log clearing after each session"
      },
      {
        "tCode": "T1046",
        "name": "Network Service Discovery",
        "tactic": "Discovery"
      },
      {
        "tCode": "T1018",
        "name": "Remote System Discovery",
        "tactic": "Discovery"
      },
      {
        "tCode": "T1005",
        "name": "Data from Local System",
        "tactic": "Collection",
        "note": "OT network diagrams, GIS data, and operational documentation"
      },
      {
        "tCode": "T1560.001",
        "name": "Archive Collected Data: Archive via Utility",
        "tactic": "Collection"
      },
      {
        "tCode": "T1219",
        "name": "Remote Access Software",
        "tactic": "Command and Control"
      }
    ],
    "cves": [
      {
        "cveId": "CVE-2024-39717",
        "firstExploited": "2024-04-01",
        "zeroDay": true,
        "usage": "Versa Director zero-day used to implant a credential-harvesting web shell (VersaMem) at internet service providers and managed service providers — an upstream position giving visibility into many downstream networks at once.",
        "source": {
          "org": "Black Lotus Labs (Lumen)",
          "title": "Taking the Crossroads: The Versa Director Zero-Day Exploitation",
          "url": "https://blog.lumen.com/taking-the-crossroads-the-versa-director-zero-day-exploitation/",
          "date": "2024-08-27"
        }
      },
      {
        "cveId": "CVE-2021-40539",
        "firstExploited": "2021-09-01",
        "usage": "Zoho ManageEngine ADSelfService Plus authentication bypass used for initial access to targeted networks.",
        "source": {
          "org": "Microsoft Threat Intelligence",
          "title": "Volt Typhoon targets US critical infrastructure with living-off-the-land techniques",
          "url": "https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/",
          "date": "2023-05-24"
        }
      },
      {
        "cveId": "CVE-2022-42475",
        "firstExploited": "2023-01-01",
        "usage": "FortiOS SSL-VPN heap overflow exploited for perimeter access to critical infrastructure networks.",
        "source": {
          "org": "CISA / NSA / FBI",
          "title": "PRC State-Sponsored Actors Compromise U.S. Critical Infrastructure (AA24-038A)",
          "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-038a",
          "date": "2024-02-07"
        }
      },
      {
        "cveId": "CVE-2023-27997",
        "firstExploited": "2023-07-01",
        "usage": "FortiOS SSL-VPN pre-authentication heap overflow used to reach critical infrastructure perimeters.",
        "source": {
          "org": "CISA / NSA / FBI",
          "title": "PRC State-Sponsored Actors Compromise U.S. Critical Infrastructure (AA24-038A)",
          "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-038a",
          "date": "2024-02-07"
        }
      },
      {
        "cveId": "CVE-2023-46805",
        "firstExploited": "2024-01-01",
        "usage": "Ivanti Connect Secure authentication bypass chained for unauthenticated access to VPN appliances.",
        "source": {
          "org": "CISA / NSA / FBI",
          "title": "PRC State-Sponsored Actors Compromise U.S. Critical Infrastructure (AA24-038A)",
          "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-038a",
          "date": "2024-02-07"
        }
      }
    ],
    "relationships": [
      {
        "relatedActorId": "salt-typhoon",
        "type": "same-sponsor",
        "confidence": "high",
        "note": "Both PRC state-sponsored with telecommunications focus, but strategically opposite: Volt Typhoon pre-positions for disruption, Salt Typhoon collects intelligence."
      },
      {
        "relatedActorId": "berserk-bear",
        "type": "operational-overlap",
        "confidence": "low",
        "note": "No shared infrastructure or tooling. Included as an analytical parallel — both hold long-dwell critical-infrastructure access with no collection payoff."
      },
      {
        "relatedActorId": "apt40",
        "type": "same-sponsor",
        "confidence": "moderate",
        "note": "Both PRC state-sponsored with a shared preference for rapid edge-device exploitation."
      }
    ],
    "reports": [
      {
        "org": "Microsoft Threat Intelligence",
        "title": "Volt Typhoon targets US critical infrastructure with living-off-the-land techniques",
        "url": "https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/",
        "date": "2023-05-24"
      },
      {
        "org": "CISA and partners",
        "title": "AA24-038A: PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure",
        "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-038a",
        "date": "2024-02-07"
      },
      {
        "org": "Dragos",
        "title": "VOLTZITE Espionage Operations Targeting U.S. Critical Systems",
        "url": "https://www.dragos.com/blog/vOLTzite-analysis/",
        "date": "2024-02-13"
      },
      {
        "org": "Black Lotus Labs (Lumen)",
        "title": "Routers Roasting on an Open Firewall: the KV-botnet investigation",
        "url": "https://blog.lumen.com/routers-roasting-on-an-open-firewall-the-kv-botnet-investigation/",
        "date": "2023-12-13"
      }
    ],
    "campaigns": [
      {
        "id": "volt-critical-infra",
        "actorId": "volt-typhoon",
        "name": "U.S. Critical Infrastructure Pre-Positioning",
        "date": "2021-01-01",
        "significance": "landmark",
        "targetSectors": [
          "Critical Infrastructure",
          "Energy",
          "Water & Wastewater",
          "Telecommunications",
          "Transportation",
          "Maritime"
        ],
        "targetCountries": [
          "United States",
          "Guam"
        ],
        "cveIds": [
          "CVE-2021-40539",
          "CVE-2022-42475",
          "CVE-2023-27997"
        ],
        "summary": "Persistent access maintained inside U.S. communications, energy, transportation, and water systems for at least five years with no meaningful data theft. CISA assesses the access exists to enable disruptive effects in the event of conflict. Guam, the principal U.S. power projection hub in the Pacific, featured prominently.",
        "sources": [
          {
            "org": "CISA / NSA / FBI and partners",
            "title": "AA24-038A: PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure",
            "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-038a",
            "date": "2024-02-07"
          }
        ]
      }
    ],
    "flag": "🇨🇳",
    "profile": "/apt/volt-typhoon/"
  }
}