Volt Typhoon is a People's Republic of China (PRC) state-sponsored actor that has been active since at least 2021, primarily targeting critical infrastructure organizations in the US and its territories including Guam. Volt Typhoon's targeting and pattern of behavior have been assessed as pre-positioning to enable lateral movement to operational technology (OT) assets for potential destructive or disruptive attacks. Volt Typhoon has emphasized stealth in operations using web shells, living-off-the-land (LOTL) binaries, hands on keyboard activities, and stolen credentials.1234. The group has leveraged compromised SOHO routers to proxy command and control traffic and obscure its infrastructure, activity associated with the KV botnet.5. Reporting indicates a separate initial access cluster, SYLVANITE, has been observed exploiting internet-facing edge devices and transferring access to Volt Typhoon, also tracked as VOLTZITE, for follow-on operations. 6
- CISA AA24-038A PRC Critical Infrastructure February 2024
- Microsoft Volt Typhoon May 2023
- Joint Cybersecurity Advisory Volt Typhoon June 2023
- Secureworks BRONZE SILHOUETTE May 2023
- DOJ KVBotnet 2024
- Dragos 2025 Year in Review
Claims and citations
Every claim comes from a writer; provenance is the writer's assertion, not a review verdict from this directory. Validity reads by citation year.
| predicate | object | Valid | Conf. | Evidence |
|---|---|---|---|---|
| also_known_as | Volt Typhoon | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | BRONZE SILHOUETTE | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | Vanguard Panda | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | DEV-0391 | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | UNC3236 | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | Voltzite | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | Insidious Taurus | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | DazedToad | — → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1046 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1083 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1591.004 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1057 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1021.001 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1584.004 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1090 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1518 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1584.008 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1056.001 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036.005 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036.008 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.003 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1190 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1555 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1074 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1590 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1560.001 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1124 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1069.002 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1016 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1018 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1047 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1133 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1140 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1570 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1593 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1680 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1589.002 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1497.001 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.003 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.002 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1573.001 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.001 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1685.005 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1584.005 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1592 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1049 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1087.001 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1217 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.001 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1654 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1068 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1113 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1090.001 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1587.004 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1090.003 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1594 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1033 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1112 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1505.003 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1218 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.004 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1007 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1069 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1584.003 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1555.003 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1591 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1590.004 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1010 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1069.001 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1120 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1070.004 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1588.006 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1105 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1552 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078.002 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1005 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1006 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1012 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1589 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1588.002 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1596.005 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1087.002 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1614 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1070.007 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1016.001 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1552.004 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1074.001 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1590.006 | 2023 → … | 100 | src_mitre_attck_enterprise |
Technique use
| ATT&CK | Technique | platforms |
|---|---|---|
| T1003.001 | LSASS Memory | — |
| T1003.003 | NTDS | — |
| T1005 | Data from Local System | — |
| T1006 | Direct Volume Access | — |
| T1007 | System Service Discovery | — |
| T1010 | Application Window Discovery | — |
| T1012 | Query Registry | — |
| T1016 | System Network Configuration Discovery | — |
| T1016.001 | Internet Connection Discovery | — |
| T1018 | Remote System Discovery | — |
| T1021.001 | Remote Desktop Protocol | — |
| T1027.002 | Software Packing | — |
| T1033 | System Owner/User Discovery | — |
| T1036.005 | Match Legitimate Resource Name or Location | — |
| T1036.008 | Masquerade File Type | — |
| T1046 | Network Service Discovery | — |
| T1047 | Windows Management Instrumentation | — |
| T1049 | System Network Connections Discovery | — |
| T1056.001 | Keylogging | — |
| T1057 | Process Discovery | — |
| T1059.001 | PowerShell | — |
| T1059.003 | Windows Command Shell | — |
| T1059.004 | Unix Shell | — |
| T1068 | Exploitation for Privilege Escalation | — |
| T1069 | Permission Groups Discovery | — |
| T1069.001 | Local Groups | — |
| T1069.002 | Domain Groups | — |
| T1070.004 | File Deletion | — |
| T1070.007 | Clear Network Connection History and Configurations | — |
| T1074 | Data Staged | — |
| T1074.001 | Local Data Staging | — |
| T1078 | Valid Accounts | — |
| T1078.002 | Domain Accounts | — |
| T1083 | File and Directory Discovery | — |
| T1087.001 | Local Account | — |
| T1087.002 | Domain Account | — |
| T1090 | Proxy | — |
| T1090.001 | Internal Proxy | — |
| T1090.003 | Multi-hop Proxy | — |
| T1105 | Ingress Tool Transfer | — |
| T1112 | Modify Registry | — |
| T1113 | Screen Capture | — |
| T1120 | Peripheral Device Discovery | — |
| T1124 | System Time Discovery | — |
| T1133 | External Remote Services | — |
| T1140 | Deobfuscate/Decode Files or Information | — |
| T1190 | Exploit Public-Facing Application | — |
| T1217 | Browser Information Discovery | — |
| T1218 | System Binary Proxy Execution | — |
| T1497.001 | System Checks | — |
| T1505.003 | Web Shell | — |
| T1518 | Software Discovery | — |
| T1552 | Unsecured Credentials | — |
| T1552.004 | Private Keys | — |
| T1555 | Credentials from Password Stores | — |
| T1555.003 | Credentials from Web Browsers | — |
| T1560.001 | Archive via Utility | — |
| T1570 | Lateral Tool Transfer | — |
| T1573.001 | Symmetric Cryptography | — |
| T1584.003 | Virtual Private Server | — |
| T1584.004 | Server | — |
| T1584.005 | Botnet | — |
| T1584.008 | Network Devices | — |
| T1587.004 | Exploits | — |
| T1588.002 | Tool | — |
| T1588.006 | Vulnerabilities | — |
| T1589 | Gather Victim Identity Information | — |
| T1589.002 | Email Addresses | — |
| T1590 | Gather Victim Network Information | — |
| T1590.004 | Network Topology | — |
| T1590.006 | Network Security Appliances | — |
| T1591 | Gather Victim Org Information | — |
| T1591.004 | Identify Roles | — |
| T1592 | Gather Victim Host Information | — |
| T1593 | Search Open Websites/Domains | — |
| T1594 | Search Victim-Owned Websites | — |
| T1596.005 | Scan Databases | — |
| T1614 | System Location Discovery | — |
| T1654 | Log Enumeration | — |
| T1680 | Local Storage Discovery | — |
| T1685.005 | Clear Windows Event Logs | — |
Aliases
BRONZE SILHOUETTE · DazedToad · DEV-0391 · Insidious Taurus · UNC3236 · Vanguard Panda · Volt Typhoon · Voltzite
Reading and review
Records are auto-ingested and not human-reviewed. Confidence is the writer's 0–100 value; bands split at ≥80 / 50–79 / <50 into high / medium / low. The four trust axes (synthetic, lifecycle, band, source count) stay separate and never merge into one score.