CISA Director Jen Easterly testified to Congress in January 2024: "This threat is not theoretical. CISA teams have found and eradicated Chinese intrusions into critical infrastructure across multiple sectors. And what we've found to date is likely the tip of the iceberg."

Volt Typhoon is not conducting espionage. They are pre-positioning for disruption or destruction of US critical services in the event of military conflict. CISA confirmed compromises across communications, energy, transportation, and water systems, with documented dwell times exceeding five years. They target strategically significant locations: Guam (Andersen Air Force Base), Hawaii, West Coast ports, and Texas energy infrastructure.

What makes them operationally distinct from every other Chinese APT: they deploy no malware. No implants, no custom backdoors, no C2 beacons. Every action uses valid credentials and built-in operating system tools. Their activity is indistinguishable from legitimate administration without behavioral baselines.

Volt Typhoon gains initial access primarily through internet-facing edge devices with known vulnerabilities. They do not rely on phishing.

• CVE-2022-42475 FortiOS SSL-VPN heap buffer overflow. Documented entry point in the Guam compromise. Allows RCE on FortiGate appliances without authentication.
• CVE-2023-27997 FortiOS SSL-VPN pre-auth RCE (XORtigate). Additional FortiGate exploitation vector.
• CVE-2021-40539 Zoho ManageEngine ADSelfService Plus. Exploited to reset domain account passwords and create new admin accounts.
• CVE-2021-27860 FatPipe WARP/IPVPN/MPVPN. Network device exploitation for initial foothold.
• CVE-2023-46805 / CVE-2024-21887 Ivanti Connect Secure. VPN appliance exploitation chain.
• End-of-life SOHO routers Cisco RV320/325, Netgear ProSafe. Default credentials and unpatched firmware. Used for the KV Botnet relay infrastructure.

Every command below is a native Windows utility. That is the entire point. These are the specific commands CISA documented in Volt Typhoon compromises.

1. 1. Audit all edge device patch status FortiGate, Ivanti, Pulse Secure, Citrix ADC, F5 BIG-IP, Zoho ManageEngine. Any unpatched internet-facing appliance is a candidate entry point. Check for the specific CVEs listed above. If an appliance was vulnerable during the exploitation window, assume it was compromised until proven otherwise. NET: Initial Access
2. 2. Search for netsh portproxy rules Run netsh interface portproxy show all on every Windows host. Any portproxy rule is suspicious in most environments. Volt Typhoon uses v4tov4 forwarding rules as persistent C2 relays. These survive reboots and leave no service or scheduled task artifact. HOST: Defense Evasion · NET: C2
3. 3. Hunt for ntdsutil IFM snapshots Search for ntdsutil execution (Sysmon EID 1) and for ntds.dit files outside C:\Windows\NTDS\. CISA documented Volt Typhoon staging ntds.dit extractions in C:\Users\Public\pro and C:\Windows\Temp\tmp. Any ntds.dit in a non-standard path is near-certain credential theft. HOST: T1003.003 NTDS.dit
4. 4. Check for renamed archive utilities Volt Typhoon renamed rar.exe to ronf.exe to avoid detection. Search for known archive tool hashes (rar, 7z) executing under non-standard filenames. Sysmon EID 1 OriginalFileName field reveals the true identity even when renamed. HOST: Defense Evasion · Sysmon EID 1 OriginalFileName
5. 5. Baseline authentication sources for privileged accounts Pull 60-90 days of EID 4624 for all Domain Admin and service accounts. Build a map of normal source IPs, times, and logon types. Volt Typhoon authenticates as valid users from valid-looking sources. The anomaly is a source IP outside the baseline, particularly residential ISP addresses (SOHO router relay). HOST: T1550.002 Pass the Hash · Security EID 4624
6. 6. Hunt for WMIC remote process creation wmic /node:<target> process call create across your Sysmon/process creation logs. Volt Typhoon uses WMI for remote execution to create staging directories and extract credentials. On the target, this appears as WmiPrvSE.exe spawning cmd.exe. HOST: T1047 WMI · HOST: Execution
7. 7. Check for event log clearing Search for wevtutil cl in Sysmon EID 1, and for Security EID 1102 (log cleared). Volt Typhoon clears all four major logs (Application, Security, Setup, System) as a standard cleanup step. Clearing all four in sequence is high-confidence Volt Typhoon tradecraft. HOST: T1070.001 Clear Event Logs
8. 8. Inspect IIS web servers for web shells Volt Typhoon deployed a base64-encoded web shell (iisstart.aspx) via certutil -decode. Search for: certutil -decode commands (Sysmon EID 1), new .aspx/.jspx files in web directories (Sysmon EID 11), and any iisstart.aspx that isn't the default IIS splash page. HOST: Persistence · HOST: Execution
9. 9. Check for inbound connections from residential IPs Volt Typhoon routes traffic through compromised SOHO routers. Inbound management connections (RDP, SSH, VPN) from residential ISP IP ranges (Comcast, AT&T, Verizon residential blocks) to your infrastructure, especially outside business hours, are a red flag. Cross-reference with known SOHO router IP ranges. NET: C2 · Firewall/VPN logs · GeoIP + ASN analysis
10. 10. Check for FOFA reconnaissance of your infrastructure Volt Typhoon uses FOFA (fofa.info), a Chinese internet search engine, for pre-exploitation reconnaissance. Check your web server access logs for requests from FOFA scanner user-agents or FOFA's known IP ranges. This is a pre-compromise indicator. NET: Reconnaissance · Web server access logs
11. 11. Audit scheduled tasks and cron jobs Volt Typhoon uses schtasks /create for persistence. Search for scheduled tasks created outside maintenance windows, particularly those executing PowerShell, cmd, or wmic. On Linux infrastructure, check cron.d for unpackaged entries. HOST: Persistence · HOST: Discovery
12. 12. Look for staging directories CISA documented Volt Typhoon using: C:\Users\Public\pro, C:\Windows\Temp\tmp, C:\Windows\Temp\tmp\Active Directory, C:\Windows\Temp\tmp\registry. Search for these specific paths and for any unexpected subdirectories in Public or Temp containing .dit, .hiv, or archive files. HOST: T1003.003 NTDS · Sysmon EID 11 file creation

No custom tooling. APT41 deploys ShadowPad and PlugX. APT10 uses custom loaders. Mustang Panda uses PlugX variants. Volt Typhoon uses nothing that isn't already on the machine. The only documented exception is a single web shell and the use of Fast Reverse Proxy (FRP), a publicly available open-source tool.

Pre-positioning, not espionage. Other Chinese APTs steal intellectual property, government secrets, and defense data. Volt Typhoon does not exfiltrate data for intelligence purposes. They establish persistent access to infrastructure that would be operationally relevant in a military conflict: power grids, water systems, ports, telecommunications.

Dwell time measured in years. Most APTs operate in weeks to months. CISA confirmed Volt Typhoon maintained access for at least five years in some environments. Their operational tempo is patient: they check in, maintain access, and wait.

Residential IP C2. Other APTs use VPS hosting, bulletproof hosting, or cloud infrastructure for C2. Volt Typhoon routes through compromised home routers, making their traffic appear to come from residential broadband connections. This defeats every IP reputation system.

Dragos elevated VOLTZITE (their tracking name for Volt Typhoon-linked activity) to ICS Kill Chain Stage 2 in 2025 after observing a critical capability shift: VOLTZITE moved beyond data exfiltration to directly manipulating engineering workstations. They compromised Sierra Wireless Airlink RV50/RV55 cellular gateways in electric and oil and gas organizations, pivoted to engineering workstations, and "manipulated the software to dump configuration files and alarm data to investigate what would trigger operational processes to stop."

This is the line between reconnaissance and pre-attack positioning. VOLTZITE is no longer just collecting data about OT environments. They are actively testing how to cause physical consequences.

SYLVANITE: the initial access team. Dragos identified SYLVANITE as a new threat group operating as Volt Typhoon's initial access provider. SYLVANITE rapidly weaponizes edge device vulnerabilities (Ivanti EPMM, F5 BIG-IP, SAP NetWeaver, ConnectWise ScreenConnect) and hands off compromised environments to VOLTZITE within days. This paired model (SYLVANITE for access, VOLTZITE for OT operations) mirrors the KAMACITE/ELECTRUM (Sandworm) division of labor and compresses the timeline from initial breach to operational readiness.

GIS data as a weapon. VOLTZITE exploited Trimble Cityworks GIS software (CVE-2025-0994) to steal geographic information system data about the layout and architecture of energy systems. GIS data maps physical assets and operational relationships. Stolen GIS data enables adversaries to plan precise, disruptive attacks on electric and water utilities.

AA23-144A (May 2023): Initial disclosure. Microsoft and CISA detail Volt Typhoon's LOTL activity across US critical infrastructure.
AA24-038A (February 2024): Major update. Five-year dwell confirmed. Detailed TTPs, staging paths, and specific commands. Supplemental LOTL detection guidance published alongside.
FBI KV Botnet disruption (January 2024): DOJ announces court-authorized takedown of Volt Typhoon's SOHO router botnet. Infrastructure rebuilt within 37 days.

Living-off-the-Land Activity (triage playbook for LOTL confirmation methodology)
Air-Gapped OT / ICS (environment playbook for the infrastructure Volt Typhoon targets)
Compromised Credentials (Volt Typhoon's primary access method is valid credential abuse)