Volt Typhoon

Volt Typhoon, a state-sponsored threat actor based in China, has been identified as a significant cybersecurity risk to critical infrastructure sectors in the United States. According to Microsoft and the Five Eyes cybersecurity and intelligence agencies, Volt Typhoon has compromised IT environments of organizations across multiple sectors including water, energy, telecommunications, and transportation. The group has demonstrated strong operational security and sophisticated techniques such as obfuscating their malware and performing reconnaissance and lateral movement within compromised networks. Their activities suggest an intent to pre-position themselves on these networks for potential disruptive or destructive cyberattacks during a major crisis or conflict with the U.S. The group is also implicated in exploiting zero-day vulnerabilities, notably CVE-2023-27997, which was used against FortiOS/FortiProxy. This vulnerability was also exploited by another threat group, Earth Kasha, suggesting that these zero-day vulnerabilities may be shared among China-nexus actors or potentially provided by third-party access brokers. However, despite this similarity, the post-exploitation tactics, techniques, and procedures (TTPs) and toolsets used by Volt Typhoon and Earth Kasha are markedly different. Despite not using ransomware itself, Volt Typhoon benefits from the Ransomware-as-a-Service (RaaS) ecosystem, where ransom payments fund the development of advanced tools, escalating attack risks. The STRIKE Team's report concludes that as Volt Typhoon's botnet spreads and its tactics deepen, governments and corporations must urgently address weaknesses in legacy systems, public cloud infrastructures, and third-party networks. Without decisive action, the silent threat posed by Volt Typhoon could trigger a critical infrastructure crisis driven by unresolved vulnerabilities.