BRONZE SILHOUETTE

Bronze Silhouette, also known as Volt Typhoon, Vanguard Panda, Dev-0391, UNC3236, Voltzite, and Insidious Taurus, is a state-sponsored cyberespionage group linked to the People's Republic of China (PRC). The threat actor group has been active since at least 2021, targeting US government entities, defense organizations, and critical infrastructure sectors such as utilities, energy companies, military bases, telecom companies, and industrial sites. In recent activities, it has adopted operational relay box networks (ORBs), often running them off stolen or leased proxies, or via home or small office routers, to conduct its operations. The U.S. Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA), Federal Bureau of Investigation (FBI), along with partners including Secureworks, have released an advisory warning critical infrastructure organizations about Bronze Silhouette. This assessment is based on observations from incident response activities at compromised organizations. The STRIKE Team has also been tracking and identifying covert infrastructure linked to the group's campaign following the publication of reports of new activity attributed to Bronze Silhouette. Over a 37-day period, the cybersecurity firm observed Bronze Silhouette compromise nearly one-third of vulnerable Cisco routers. The group has installed malware that could potentially be used for widespread disruptions, such as slowing down any U.S. military response to a hypothetical Chinese invasion of Taiwan. As part of a broader Chinese effort, Bronze Silhouette continues to infiltrate various sectors to plant foothold malware, preparing for potential disruptive and destructive attacks in the future.