Vanguard Panda

Vanguard Panda, also known as Volt Typhoon, Bronze Silhouette, Insidious Taurus, and APT41, is a cyberespionage group linked to the Chinese government. Since mid-2021, this threat actor has targeted critical infrastructure sectors including manufacturing, utility, maritime, and government entities in the United States, notably in Guam. The group has demonstrated advanced intrusion tactics and familiarity with the target environment, which has led cybersecurity experts to believe that it follows a specific workflow to backdoor apache-tomcat.jar. The group's activities have escalated since May 2021, when it was recognized as a significant threat to critical infrastructure and military bases. Vanguard Panda has been observed leveraging sophisticated tactics and exploiting critical vulnerabilities, such as the one found in Zoho's ManageEngine ADSelfService Plus, a single sign-on and password management solution. Additionally, the group is believed to be part of a broader Chinese effort to infiltrate utilities, energy-sector companies, military bases, telecom companies, and industrial sites to plant foothold malware for potential disruptive and destructive attacks in the future. Recently, Microsoft exposed another China-linked actor named Volt Typhoon (aka Bronze Silhouette or Vanguard Panda), which has been observed using Living off the Land (LotL) techniques to fly under the radar and exfiltrate data. This development, along with the group's continued activity, suggests that Chinese malware poses a 'ticking time bomb' inside critical US networks. The Chinese state-aligned advanced persistent threat (APT) behind Volt Typhoon came to attention after Microsoft observed Chinese cyber activity in Guam, the site of a strategically significant US military base for the defense of Taiwan against Chinese aggression. As a result, cybersecurity experts recommend a deeper dive into associated activities to determine if other artifacts remain and could confirm the use of specific exploits or indicate another form of exploitation altogether.