Pre-positioning inside U.S. critical infrastructure with no collection payoff — access held for five years for use in a future conflict.
Volt Typhoon is the clearest public example of cyber pre-positioning, and it broke the analytical model most defenders were using.
Espionage groups steal things. Volt Typhoon largely doesn't. CISA's February 2024 advisory documented the actor maintaining access inside U.S. communications, energy, transportation, and water systems for at least five years — with no meaningful data theft. The U.S. government's assessment is unambiguous: the access exists to enable disruptive or destructive effects against critical infrastructure in the event of a major crisis or conflict with the United States.
Its tradecraft is defined by what it does not use. Operations run almost entirely on living-off-the-land techniques — wmic, ntdsutil, netsh, PowerShell, and certutil — with essentially no custom malware on victim endpoints. Command and control traverses compromised small-office routers and network devices, chiefly end-of-life Cisco and NETGEAR equipment inside the victim's own geography, so the traffic never crosses a border and never resembles a foreign connection. Credentials come from offline extraction of the NTDS.dit domain database rather than in-memory dumping.
The result is a threat that produces almost no atomic indicators. There is nothing to blocklist; detection depends on behavioural analysis of legitimate administrative activity.
Targeting choices reinforce the assessment. Guam — the principal U.S. power projection hub in the Western Pacific — has featured prominently. So have water utilities and port operators: organisations with negligible intelligence value and enormous disruption value.
In January 2024 the FBI executed a court-authorised operation to remotely delete the KV Botnet malware from hundreds of U.S.-based end-of-life SOHO routers that formed the group's covert relay layer.
Down to the named unit where public evidence supports it.
Attributed to a People's Republic of China state-sponsored actor in a May 2023 joint advisory from NSA, CISA, FBI, and the cyber security authorities of Australia, Canada, New Zealand, and the United Kingdom, published alongside independent Microsoft reporting. A February 2024 follow-on advisory raised the assessment substantially, stating that the actor is pre-positioning for disruptive effects rather than conducting espionage. No specific PLA or MSS unit has been publicly named, and no individuals have been indicted.
Attributing sources
9 designators across 9 organisations.
Assigns a stable Gxxxx group ID and adopts the most widely used public name. Deliberately conservative — MITRE merges clusters only when public reporting supports it.
Weather-event family encodes the attributed origin; the adjective is arbitrary. Renamed from the older element taxonomy (STRONTIUM, NOBELIUM, HAFNIUM) in April 2023. 'Storm-####' is a temporary designator for a cluster still in development.
Animal denotes attributed nation-state or motive; the adjective distinguishes clusters. The original public adversary taxonomy, in use since 2012.
APTxx for state-nexus espionage, FINxx for financially motivated, UNCxxxx ('uncategorized') for clusters not yet graduated to a named group. Many UNC numbers are later merged into an APT/FIN designator.
Metal prefix encodes attributed origin, paired with an arbitrary uppercase codeword.
Constellation denotes attributed origin or motive, adopted in 2023 to replace ad-hoc naming.
Names activity clusters descriptively rather than by a fixed nation-state taxonomy, and generally adopts the prevailing community name for established state actors. Coverage skews toward commodity and eCrime threats seen in managed-detection telemetry.
Mineral names for groups with demonstrated or assessed intent against industrial control systems. A Dragos designator is a meaningful signal: it means OT/ICS capability, not just IT intrusion.
U.S. government advisories generally reference groups by the most common industry name plus the attributed unit. Joint advisories are the authoritative source for unit-level attribution.
Target sectors
Target geography
Custom tooling is a strong clustering signal; shared and commodity tooling is not.
Custom / bespoke
Covert relay network built from end-of-life Cisco, NETGEAR, and DrayTek SOHO routers inside victim geographies. Disrupted by FBI action in January 2024.
Shared, commodity & living-off-the-land
Built-in Windows management interface used for discovery and remote execution — no binary to detect.
Native utility used to create shadow copies of NTDS.dit for offline credential extraction, avoiding LSASS access.
Native networking utility used to configure port proxies for internal pivoting.
Open-source reverse proxy deployed on compromised hosts for persistent tunnelled access.
Python toolkit used for WMI and SMB remote execution across the victim estate.
Public tunnelling and web shell tooling adopted in place of bespoke implants.
Filtered on the date this actor was first reported exploiting the flaw — not the CVE's publication date.
| CVE | Product | Usage by Volt Typhoon | ||
|---|---|---|---|---|
| CVE-2024-397170-day | — | — | 1 Apr 2024 | Versa Director zero-day used to implant a credential-harvesting web shell (VersaMem) at internet service providers and managed service providers — an upstream position giving visibility into many downstream networks at once.SRCBlack Lotus Labs (Lumen) ↗ |
| CVE-2023-46805KEVransomware | 8.2 | Ivanti Connect SecureIvanti | 1 Jan 2024 | Ivanti Connect Secure authentication bypass chained for unauthenticated access to VPN appliances.SRCCISA / NSA / FBI ↗ |
| CVE-2023-27997KEVransomware | 9.8 | FortiOS SSL VPNFortinet | 1 Jul 2023 | FortiOS SSL-VPN pre-authentication heap overflow used to reach critical infrastructure perimeters.SRCCISA / NSA / FBI ↗ |
| CVE-2022-42475KEVransomware | 9.8 | FortiOS SSL VPNFortinet | 1 Jan 2023 | FortiOS SSL-VPN heap overflow exploited for perimeter access to critical infrastructure networks.SRCCISA / NSA / FBI ↗ |
| CVE-2021-40539 | — | — | 1 Sep 2021 | Zoho ManageEngine ADSelfService Plus authentication bypass used for initial access to targeted networks.SRCMicrosoft Threat Intelligence ↗ |
Actors sharing exploited CVEs
How this actor moves through an intrusion, stage by stage, titled by ATT&CK tactic. Read left to right.
1 technique
Builds the covert layer before touching the target. End-of-life Cisco, NETGEAR and DrayTek routers inside the victim's own geography are compromised into the KV Botnet, so every subsequent connection originates domestically and never looks foreign.
2 techniques
Edge appliances at the perimeter — Fortinet, Ivanti, Citrix, Versa, Zoho ManageEngine — followed immediately by valid VPN credentials harvested from them. After that the actor stops looking like an intruder.
1 technique
Native tooling only — wmic, netsh, PowerShell, certutil, ntdsutil. Every command is one a system administrator plausibly runs, which is precisely why the tradecraft produces almost no atomic indicators.
1 technique
Legitimate administrator credentials, and nothing else. There is no implant to find, no scheduled task to audit, no binary to blocklist. CISA documented access maintained this way for at least five years.
1 technique·derived
Selective, targeted log clearing after each session.
1 technique
Extracts the NTDS.dit domain database offline via volume shadow copy rather than touching LSASS, sidestepping the memory-access behaviour that EDR is built to catch.
2 techniques
Patient enumeration of the network and connected systems, with particular interest in operational technology — Dragos records collection of GIS data and electric system network diagrams.
2 techniques
OT network diagrams, operational documentation, and the engineering detail required to understand a physical process — not the intellectual property or correspondence an espionage actor would take.
2 techniques
Out through the compromised SOHO router layer to infrastructure that never crosses a border. Selective log clearing after each session removes the session, not the whole log, which would itself be an indicator.
Scroll horizontally · characteristic chain across documented operations, not a single incident
Grouped in kill-chain order.
KV Botnet of end-of-life SOHO routers, selected to be in-country relative to victims
Fortinet, Citrix, Ivanti, and Zoho ManageEngine appliances at the network edge
Valid VPN credentials harvested from edge devices
Legitimate administrator credentials in place of malware persistence
Selective, targeted log clearing after each session
Offline extraction via volume shadow copy — never touches LSASS
OT network diagrams, GIS data, and operational documentation
netsh portproxy chains through internal hosts
Persistent access maintained inside U.S. communications, energy, transportation, and water systems for at least five years with no meaningful data theft. CISA assesses the access exists to enable disruptive effects in the event of conflict. Guam, the principal U.S. power projection hub in the Pacific, featured prominently.
Relationship type and confidence stated explicitly — 'related' without qualification is not an assessment.
Both PRC state-sponsored with telecommunications focus, but strategically opposite: Volt Typhoon pre-positions for disruption, Salt Typhoon collects intelligence.
No shared infrastructure or tooling. Included as an analytical parallel — both hold long-dwell critical-infrastructure access with no collection payoff.
Both PRC state-sponsored with a shared preference for rapid edge-device exploitation.
Curated links to the reports that established what is known about this group.