Volt Typhoon is a People's Republic of China (PRC) state-sponsored actor that has been active since at least 2021, primarily targeting critical infrastructure organizations in the US and its territories including Guam. Volt Typhoon's targeting and pattern of behavior have been assessed as pre-positioning to enable lateral movement to operational technology (OT) assets for potential destructive or disruptive attacks. Volt Typhoon has emphasized stealth in operations using web shells, living-off-the-land (LOTL) binaries, hands on keyboard activities, and stolen credentials.1234. The group has leveraged compromised SOHO routers to proxy command and control traffic and obscure its infrastructure, activity associated with the KV botnet.5. Reporting indicates a separate initial access cluster, SYLVANITE, has been observed exploiting internet-facing edge devices and transferring access to Volt Typhoon, also tracked as VOLTZITE, for follow-on operations. 6
- CISA AA24-038A PRC Critical Infrastructure February 2024
- Microsoft Volt Typhoon May 2023
- Joint Cybersecurity Advisory Volt Typhoon June 2023
- Secureworks BRONZE SILHOUETTE May 2023
- DOJ KVBotnet 2024
- Dragos 2025 Year in Review
断言与引用
每条断言来自写入方；provenance 是写入方声称，不是本目录的复核结论。有效期按引用年份读取。
| predicate | object | 有效期 | 置信 | 证据 |
|---|---|---|---|---|
| also_known_as | Volt Typhoon | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | BRONZE SILHOUETTE | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | Vanguard Panda | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | DEV-0391 | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | UNC3236 | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | Voltzite | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | Insidious Taurus | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | DazedToad | — → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1046 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1083 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1591.004 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1057 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1021.001 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1584.004 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1090 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1518 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1584.008 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1056.001 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036.005 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036.008 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.003 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1190 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1555 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1074 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1590 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1560.001 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1124 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1069.002 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1016 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1018 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1047 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1133 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1140 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1570 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1593 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1680 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1589.002 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1497.001 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.003 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.002 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1573.001 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.001 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1685.005 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1584.005 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1592 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1049 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1087.001 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1217 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.001 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1654 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1068 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1113 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1090.001 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1587.004 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1090.003 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1594 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1033 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1112 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1505.003 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1218 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.004 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1007 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1069 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1584.003 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1555.003 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1591 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1590.004 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1010 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1069.001 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1120 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1070.004 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1588.006 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1105 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1552 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078.002 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1005 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1006 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1012 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1589 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1588.002 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1596.005 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1087.002 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1614 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1070.007 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1016.001 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1552.004 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1074.001 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1590.006 | 2023 → … | 100 | src_mitre_attck_enterprise |
技术使用
| ATT&CK | 技术 | platforms |
|---|---|---|
| T1003.001 | LSASS Memory | — |
| T1003.003 | NTDS | — |
| T1005 | Data from Local System | — |
| T1006 | Direct Volume Access | — |
| T1007 | System Service Discovery | — |
| T1010 | Application Window Discovery | — |
| T1012 | Query Registry | — |
| T1016 | System Network Configuration Discovery | — |
| T1016.001 | Internet Connection Discovery | — |
| T1018 | Remote System Discovery | — |
| T1021.001 | Remote Desktop Protocol | — |
| T1027.002 | Software Packing | — |
| T1033 | System Owner/User Discovery | — |
| T1036.005 | Match Legitimate Resource Name or Location | — |
| T1036.008 | Masquerade File Type | — |
| T1046 | Network Service Discovery | — |
| T1047 | Windows Management Instrumentation | — |
| T1049 | System Network Connections Discovery | — |
| T1056.001 | Keylogging | — |
| T1057 | Process Discovery | — |
| T1059.001 | PowerShell | — |
| T1059.003 | Windows Command Shell | — |
| T1059.004 | Unix Shell | — |
| T1068 | Exploitation for Privilege Escalation | — |
| T1069 | Permission Groups Discovery | — |
| T1069.001 | Local Groups | — |
| T1069.002 | Domain Groups | — |
| T1070.004 | File Deletion | — |
| T1070.007 | Clear Network Connection History and Configurations | — |
| T1074 | Data Staged | — |
| T1074.001 | Local Data Staging | — |
| T1078 | Valid Accounts | — |
| T1078.002 | Domain Accounts | — |
| T1083 | File and Directory Discovery | — |
| T1087.001 | Local Account | — |
| T1087.002 | Domain Account | — |
| T1090 | Proxy | — |
| T1090.001 | Internal Proxy | — |
| T1090.003 | Multi-hop Proxy | — |
| T1105 | Ingress Tool Transfer | — |
| T1112 | Modify Registry | — |
| T1113 | Screen Capture | — |
| T1120 | Peripheral Device Discovery | — |
| T1124 | System Time Discovery | — |
| T1133 | External Remote Services | — |
| T1140 | Deobfuscate/Decode Files or Information | — |
| T1190 | Exploit Public-Facing Application | — |
| T1217 | Browser Information Discovery | — |
| T1218 | System Binary Proxy Execution | — |
| T1497.001 | System Checks | — |
| T1505.003 | Web Shell | — |
| T1518 | Software Discovery | — |
| T1552 | Unsecured Credentials | — |
| T1552.004 | Private Keys | — |
| T1555 | Credentials from Password Stores | — |
| T1555.003 | Credentials from Web Browsers | — |
| T1560.001 | Archive via Utility | — |
| T1570 | Lateral Tool Transfer | — |
| T1573.001 | Symmetric Cryptography | — |
| T1584.003 | Virtual Private Server | — |
| T1584.004 | Server | — |
| T1584.005 | Botnet | — |
| T1584.008 | Network Devices | — |
| T1587.004 | Exploits | — |
| T1588.002 | Tool | — |
| T1588.006 | Vulnerabilities | — |
| T1589 | Gather Victim Identity Information | — |
| T1589.002 | Email Addresses | — |
| T1590 | Gather Victim Network Information | — |
| T1590.004 | Network Topology | — |
| T1590.006 | Network Security Appliances | — |
| T1591 | Gather Victim Org Information | — |
| T1591.004 | Identify Roles | — |
| T1592 | Gather Victim Host Information | — |
| T1593 | Search Open Websites/Domains | — |
| T1594 | Search Victim-Owned Websites | — |
| T1596.005 | Scan Databases | — |
| T1614 | System Location Discovery | — |
| T1654 | Log Enumeration | — |
| T1680 | Local Storage Discovery | — |
| T1685.005 | Clear Windows Event Logs | — |
别名
BRONZE SILHOUETTE · DazedToad · DEV-0391 · Insidious Taurus · UNC3236 · Vanguard Panda · Volt Typhoon · Voltzite
读取与复核
记录自动入库·未人工复核。置信度是写入方给出的 0–100 值，置信带按 ≥80 / 50–79 / <50 划为高 / 中 / 低；四条信任轴（合成、生命周期、置信带、佐证源数）分开呈现，不合并为单一信任分。