BRONZE SILHOUETTE

Bronze Silhouette, also known as Volt Typhoon, Vanguard Panda, and Insidious Taurus, is a Chinese state-sponsored cyberespionage group that has been targeting U.S. government and defense organizations. The threat actor has been active since at least 2021, but it was only in May 2023 when the National Security Agency (NSA), the Federal Bureau of Investigation (FBI), and the Cybersecurity Infrastructure Security Agency (CISA) issued a joint warning about its activities. The group uses small office/home office (SOHO) network devices to mask their operations, often running them off stolen or leased proxies, or via home or small office routers. The group's activities escalated significantly when it began targeting critical infrastructure organizations, compromising nearly one-third of vulnerable Cisco routers over a 37-day period. The campaign involved the use of operational relay box networks (ORBs), which have become a common tool for Beijing-affiliated cyberespionage groups like Bronze Silhouette. This marked a shift in the group's focus towards utilities, energy-sector companies, military bases, telecom companies, and industrial sites with the intent of planting foothold malware for potential disruptive and destructive attacks. In response to this escalating threat, U.S. authoring agencies including CISA, NSA, FBI, and other partners have released an advisory to warn critical infrastructure organizations. They are urging these organizations to take preventative actions against the sophisticated tactics employed by Bronze Silhouette. The advisory is based on observations from incident response activities at compromised organizations. The ultimate goal of these attacks appears to be the creation of widespread disruptions, potentially slowing U.S. military responses to geopolitical events such as a hypothetical Chinese invasion of Taiwan.