Volt TyphoonThreat actor
- bronze silhouette
- dazedtoad
- dev-0391
- insidious taurus
- storm-0391
- unc3236
- vanguard panda
- voltzite
[Microsoft] Volt Typhoon, a state-sponsored actor based in China that typically focuses on espionage and information gathering. Microsoft assesses with moderate confidence that this Volt Typhoon campaign is pursuing development of capabilities that could disrupt critical communications infrastructure between the United States and Asia region during future crises.From MISP Galaxy
Last reported 15 days ago, by The Hacker News8 reports
ATT&CK techniques
3 techniques · each with the sentence it comes from- T1110.003Password Spraying
“They also point to botnets used by Chinese threat actors for password spraying attacks, and to Russian hackers targeting TP-Link routers.”
- T1552.004Private Keys
“…lities in WSL can make it easier for attackers to find and steal credentials where developers are using WSL, for example for AWS, RSA private keys, and shared environment variables (i.e., WSLENV).”
- T1684Social Engineering
“This involves social engineering to get them to install and run a malicious package.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
8 reports, newest first · the exact sentence from each-
TP-Link Sued by Four More U.S. States Over Router Security and China Ties“The claim that Chinese state hackers used TP-Link routers in the Volt Typhoon and Flax Typhoon campaigns rests on testimony given in 2025.”
-
TP-Link Faces State Lawsuits and New Scrutiny Over ISP Router Flaws“To counter those claims, the states cite congressional testimony that TP-Link routers were exploited in the Volt Typhoon and Flax Typhoon campaigns.”
-
US states sue popular kitmaker TP-Link over China risks“It further cites Joyce's that TP-Link routers were among the brands exploited in the China-linked Volt Typhoon and Flax Typhoon campaigns.”
-
The US needs a real plan to defend its water systems“China’s Volt Typhoon revealed deep Chinese penetration of critical infrastructure, including water systems, that support national security, economic security, and civil society.”
-
Srsly Risky Biz: China's Private Sector Botnets Are Worth Disrupting“Two years seems a pretty good run, particularly considering the network was used by Volt Typhoon, a group compromising US critical infrastructure for potential sabotage.”
-
The Evolving Linux Threat Landscape“Volt Typhoon: A Chinese-backed nation-state group targeting critical infrastructure that has targeted network edge devices that run Linux, like home routers, in addition to enterprise-grade network gear (firewalls, VPNs, routers).”
-
Defending Critical Infrastructure Against Cyber Threats“China breached New York City's subway system in 2021, and just recently, Microsoft sounded the alarm about the China-backed Volt Typhoon gang infiltrating the critical infrastructure of Guam—a US territory and home of two strategic US military bases.”
-
Calm In The Storm: Reviewing Volt Typhoon“Calm In The Storm: Reviewing Volt Typhoon”
Thanks — we review every report.