Volt Typhoon

Volt Typhoon, a cyberespionage cluster sponsored by China, has emerged as a significant threat actor in the cybersecurity landscape. Known for its strong operational security and obfuscation of malware, Volt Typhoon is both a resilient botnet and a warning signal of potential critical infrastructure crises. The group's tactics are adaptive and multifaceted, demonstrated by their ability to dig deeper when exposed rather than retreat. In August 2023, the actors exploited a zero-day vulnerability, tracked as CVE-2024-39717, in Versa Director to deploy a custom webshell on breached networks. In the U.S., Volt Typhoon has compromised IT environments across multiple critical infrastructure sectors such as water, energy, telecommunications, and transportation. This potentially provides a launching pad for disruptive attacks. Despite not using ransomware directly, Volt Typhoon benefits from the Ransomware-as-a-Service (RaaS) ecosystem, where ransom payments fund advanced tools that escalate attack risks, particularly through third-party and cloud dependencies. Within a span of 37 days, the group was able to compromise 30% of visible Cisco RV320/325 routers, making end-of-life devices perfect entry points for them. The STRIKE Team's discoveries underscore the expanding threat posed by Volt Typhoon. As the botnet spreads and its tactics deepen, there is an urgent need for governments and corporations to address weaknesses in legacy systems, public cloud infrastructures, and third-party networks. Despite efforts to disrupt the botnet, Volt Typhoon remains active and continues to pre-position itself on IT networks for possible disruptive or destructive cyberattacks against U.S. critical infrastructure, especially in times of major crisis or conflict with the United States.