August 31, 2026
Updated: August 31, 2026
The China-linked group that is not stealing secrets, but waiting inside the power, water and comms networks it could one day switch off.
Abdalla Mohamed
Volt Typhoon is a China-linked state-sponsored hacking group that US intelligence assesses is not stealing secrets but doing something more alarming: quietly pre-positioning inside American critical infrastructure, energy, water, transportation, and communications, so it could disrupt or destroy those services during a future crisis or conflict. It hides using "living off the land" techniques that leave almost no malware behind, and it has maintained access in some victim networks for more than five years. This guide explains what Volt Typhoon is, how it operates, who it targets and why, what the CISA advisory says, its status in 2026, and how it differs from its espionage-focused sibling, Salt Typhoon.
Updated: August 2026. Reflects CISA advisory AA24-038A, the January 2024 FBI botnet disruption, and Volt Typhoon's continued activity through 2025-2026.
| Question | Short answer |
|---|---|
| What is it? | A PRC (Chinese) state-sponsored APT group (MITRE G1017) |
| What does it want? | To pre-position for disruptive/destructive attacks on US critical infrastructure, not to spy |
| How does it hide? | "Living off the land" (LOTL): using built-in tools and valid accounts, minimal malware |
| Who does it target? | Communications, energy, transportation, and water/wastewater, including Guam |
| Why Guam and the military angle? | To degrade US military response in a Pacific conflict (e.g. over Taiwan) |
| Is it still active in 2026? | Yes. Its persistence has not been confirmed fully eradicated |
The one line to remember: Volt Typhoon is not there to read your email; it is there to be able to turn off the lights, water, or comms when Beijing decides it matters.
Volt Typhoon is an advanced persistent threat (APT) group attributed to the People's Republic of China, likely operating on behalf of the People's Liberation Army (PLA) or Ministry of State Security (MSS). Microsoft first publicly disclosed it in May 2023 after finding it inside networks on Guam, home to major US military installations. Security vendors track it under several names, so you will see the same group called Vanguard Panda, BRONZE SILHOUETTE, DEV-0391, UNC3236, Voltzite (Dragos), and Insidious Taurus (Unit 42); MITRE ATT&CK catalogs it as G1017.
What makes Volt Typhoon distinct from typical Chinese cyber activity is its intent. Most nation-state hacking is espionage, stealing data. US authorities assess with high confidence that Volt Typhoon's target selection and behavior are not consistent with espionage. Instead, the CISA advisory states the group is "seeking to pre-position themselves on IT networks for disruptive or destructive cyberattacks against US critical infrastructure in the event of a major crisis or conflict." That is a fundamentally different and more dangerous mission.
Volt Typhoon's signature is stealth through living off the land (LOTL). Rather than deploying custom malware that endpoint tools would flag, it uses the legitimate administrative tools already present on a system, PowerShell, WMI, netsh, built-in Windows utilities, and operates with stolen but valid credentials. To a defender's logs, its activity looks like normal administration. That is exactly the point.
The attack pattern, per CISA and MITRE, follows a consistent arc:
This is why Volt Typhoon is so hard to catch. There is no malware signature to scan for; the defense is about spotting anomalous use of legitimate tools, which our guidance on attack surface management and behavioral detection addresses directly.
A defining chapter in the Volt Typhoon story is the KV-botnet, uncovered by Lumen's Black Lotus Labs. Active since around February 2022, it was a network of hundreds of compromised US-based SOHO routers, mostly Cisco and NetGear devices that had reached end of life, used as a covert relay layer to disguise the group's activity as ordinary residential traffic.
In January 2024, the US Department of Justice ran a court-authorized operation that disrupted the KV-botnet, deleting the malware from the hijacked routers and severing their connection to Volt Typhoon's infrastructure. It was a rare, concrete win. But it was not the end: Volt Typhoon began rebuilding its botnet within months, a reminder that disrupting infrastructure is not the same as evicting a determined state actor.
CISA confirmed Volt Typhoon compromises in four US critical-infrastructure sectors, and the choice is strategic, not opportunistic.
| Sector | Why it's targeted |
|---|---|
| Communications | Disrupting comms cripples coordination during a crisis |
| Energy | Power outages cause cascading civilian and military impact |
| Transportation Systems | Slowing logistics degrades military mobilization |
| Water and Wastewater | High civilian impact, often weakly defended |
The geography tells the strategy. Volt Typhoon's presence on Guam, and its focus on infrastructure that supports military logistics, points to a scenario the US Department of Defense takes seriously: in a Pacific conflict, such as one over Taiwan, disrupting the power, water, and communications that US forces and their staging areas depend on could slow the American response. FBI Director Christopher Wray warned Congress in 2024 that the group is positioning to "wreak havoc" and inflict "real-world harm" on Americans. This is cyber capability held in reserve as a wartime weapon, which is what separates it from ordinary hacking.
Put plainly, the threat model is pre-positioning: get in quietly, stay for years, learn the environment, and hold the ability to disrupt until it is needed. Three features make it especially serious:
The two most significant Chinese "Typhoon" groups are often mentioned together but do very different jobs, and understanding the split is the fastest way to understand both.
| Volt Typhoon | Salt Typhoon | |
|---|---|---|
| Primary goal | Pre-position to disrupt critical infrastructure | Espionage, intercept communications |
| Main targets | Energy, water, transportation, comms (incl. Guam) | Telecom and ISP backbones, government, lodging |
| Signature move | LOTL, SOHO-router botnet, pivot toward OT | Router exploitation, tapping wiretap systems, rootkits |
| Value of stolen data | Limited (it's not really spying) | Massive: calls, texts, metadata, wiretap targets |
| Governing CISA advisory | AA24-038A (2024) | AA25-239A (2025) |
In short: Volt Typhoon prepares to break things; Salt Typhoon listens. If Volt is a saboteur casing the building's utilities, Salt is a wiretap on the phone lines. We cover the espionage side in depth in our Salt Typhoon analysis, and compare the two side by side in Salt Typhoon vs Volt Typhoon.
Volt Typhoon has not gone away. After the January 2024 botnet disruption, the group moved to rebuild, and threat-intelligence firms (Dragos tracks the cluster as "Voltzite") reported continued targeting of US electric utilities and other infrastructure through 2025. As of 2026, there is no confirmed complete eradication of Volt Typhoon's persistence from US critical-infrastructure networks. The realistic assumption for any operator of critical systems is that this actor, or one like it, may already have a foothold, which is why the guidance below is about hunting and hardening, not just prevention.
Because LOTL leaves no malware to scan for, defense shifts toward hardening the edge, reducing what a valid account can do, and hunting for anomalies. CISA's core recommendations, aligned with what a mature security program should already do:
| Control | What it stops |
|---|---|
| Patch internet-facing devices fast | Closes the edge-device vulnerabilities used for initial access |
| Retire end-of-life hardware | Removes the unpatchable SOHO/edge gear the botnet relied on |
| Phishing-resistant MFA | Blunts the stolen-credential access LOTL depends on |
| Centralized, retained logging | Makes long-dwell LOTL activity visible for hunting |
| Network segmentation (IT/OT) | Stops the lateral move from IT into the OT that matters most |
| Least privilege on valid accounts | Limits what a compromised legitimate account can reach |
| Proactive threat hunting | Finds "anomalous use of legitimate tools," the only real signal |
Two program-level points matter most. First, patch and replace edge devices relentlessly, this is where Volt Typhoon gets in, and it is the same discipline covered in our patch management guide. Second, assume compromise and hunt: a group that hides in valid tools and stays for years will not trip a signature-based alarm, so you have to go looking, and a tested incident response plan determines how fast you can evict it once you do.
Because the initial access almost always runs through an exposed, exploitable device, validating your external attack surface the way an attacker would is the highest-value proactive step. That is exactly what DeepStrike's external penetration testing does: find and prove the edge exposures a group like Volt Typhoon would use, before they do.
Volt Typhoon reframes what "advanced threat" means. It is not a smash-and-grab or a ransomware payday; it is a patient, state-run effort to hold critical services at risk. For any organization connected to energy, water, transportation, communications, or their supply chains, the takeaways are concrete: your edge devices are the front door, your valid accounts are the keys, and your OT is the prize. Defending against a LOTL actor is less about buying another scanner and more about visibility, segmentation, least privilege, and the willingness to hunt for a threat that is designed not to be found.
DeepStrike's penetration testing probes the exact paths a group like Volt Typhoon uses, exposed edge devices, weak authentication, and flat IT-to-OT networks, and shows you where a state-level actor could gain and hold access. For US-based critical-infrastructure teams, see our US penetration testing services.
Volt Typhoon is a Chinese state-sponsored hacking group (MITRE ATT&CK G1017) that US intelligence assesses is pre-positioning inside US critical infrastructure, energy, water, transportation, and communications, to enable disruptive or destructive cyberattacks in a future crisis or conflict, rather than to conduct traditional espionage.
Living off the land (LOTL) means the group uses the legitimate administrative tools already on a system, such as PowerShell and built-in Windows utilities, along with stolen valid credentials, instead of custom malware. This makes its activity blend in with normal administration and lets it avoid signature-based detection, sometimes for years.
CISA advisory AA24-038A (February 2024), issued with the NSA, FBI, and Five Eyes partners, warned that Volt Typhoon had compromised communications, energy, transportation, and water utilities, including on Guam, and was pre-positioning to disrupt them. It reported dwell times of at least five years and urged edge-device patching, MFA, logging, and IT/OT segmentation.
Both are Chinese state-sponsored groups, but their missions differ. Volt Typhoon pre-positions to disrupt physical critical infrastructure and holds limited espionage value. Salt Typhoon is an espionage operation that breached US telecom carriers to intercept calls, texts, and wiretap systems. Volt prepares to break things; Salt listens.
Yes. After the FBI disrupted its KV-botnet in January 2024, Volt Typhoon began rebuilding, and threat intelligence reported continued targeting of US utilities through 2025. As of 2026, its persistence in US critical-infrastructure networks has not been confirmed fully eradicated, so operators should assume ongoing risk.
Guam hosts major US military installations and is strategically vital to any Pacific operation. By pre-positioning in the power, water, and communications infrastructure that supports military logistics, Volt Typhoon could disrupt or slow a US response during a conflict, such as one over Taiwan, which is why the US Department of Defense treats it as a serious national-security threat.
Patch and retire internet-facing edge devices, enforce phishing-resistant MFA, centralize and retain logs, segment IT from OT networks, apply least privilege to valid accounts, and, crucially, hunt proactively for anomalous use of legitimate tools. Because Volt Typhoon leaves little malware, visibility and threat hunting matter more than signature-based defenses.
Stay secure with DeepStrike penetration testing services. Reach out for a quote or customized technical proposal today
Contact Us
