# Volt Typhoon: threat group profile

> Volt Typhoon is a threat group thought to operate from China. Public reporting links it to 64 attack techniques. This free profile shows how it works, stage by stage, so you can judge the risk to you. It lists the other names the group goes by and links to every public report behind it.

Canonical page: https://www.edgeprotect.io/threat-actors/volt-typhoon
Breadcrumb: [Home](https://www.edgeprotect.io/) > [Threat groups](https://www.edgeprotect.io/threat-actors) > Volt Typhoon

## At a glance

| Fact | Value |
|---|---|
| Attack techniques | 64 (plus 48 sub-techniques) |
| Thought to operate from | China |
| Other names | 7 |
| Public reports | 4 |

## Who is Volt Typhoon?

Volt Typhoon is a threat group thought to operate from China. Public reporting links it to 64 attack techniques.

### Also known as

BRONZE SILHOUETTE, VANGUARD PANDA, UNC3236, Insidious Taurus, VOLTZITE, Dev-0391, Storm-0391

Security companies each give the same group their own name, so one group can have many.

### What public reporting says

> Volt Typhoon, a state-sponsored actor based in China that typically focuses on espionage and information gathering. Microsoft assesses with moderate confidence that this Volt Typhoon campaign is pursuing development of capabilities that could disrupt critical communications infrastructure between the United States and Asia region during future crises. BRONZE SILHOUETTE likely operates on behalf the PRC. The targeting of U.S. government and defense organizations for intelligence gain aligns with PRC requirements, and the tradecraft observed in these engagements overlap with other state-sponsored Chinese threat groups.

## How does Volt Typhoon attack? Stage by stage

Each technique is a known way attackers research, get in, stay hidden or do damage. Here are the 64 linked to Volt Typhoon. Some techniques belong to more than one stage. Public reporting also lists 48 more specific variations of them, called sub-techniques.

### 1. Research (7)

- T1589: Gather Victim Identity Information
- T1590: Gather Victim Network Information
- T1591: Gather Victim Org Information
- T1592: Gather Victim Host Information
- T1593: Search Open Websites/Domains
- T1594: Search Victim-Owned Websites
- T1596: Search Open Technical Databases

### 2. Preparation (4)

- T1583: Acquire Infrastructure
- T1584: Compromise Infrastructure
- T1587: Develop Capabilities
- T1588: Obtain Capabilities

### 3. Getting in (3)

- T1078: Valid Accounts
- T1133: External Remote Services
- T1190: Exploit Public-Facing Application

### 4. Running code (2)

- T1047: Windows Management Instrumentation
- T1059: Command and Scripting Interpreter

### 5. Staying in (5)

- T1078: Valid Accounts
- T1112: Modify Registry
- T1133: External Remote Services
- T1505: Server Software Component
- T1546: Event Triggered Execution

### 6. Taking control (4)

- T1055: Process Injection
- T1068: Exploitation for Privilege Escalation
- T1078: Valid Accounts
- T1546: Event Triggered Execution

### 7. Hiding (8)

- T1006: Direct Volume Access
- T1027: Obfuscated Files or Information
- T1036: Masquerading
- T1055: Process Injection
- T1070: Indicator Removal
- T1078: Valid Accounts
- T1218: System Binary Proxy Execution
- T1497: Virtualization/Sandbox Evasion

### 8. Disabling defences (3)

- T1112: Modify Registry
- T1222: File and Directory Permissions Modification
- T1685: Disable or Modify Tools

### 9. Stealing passwords (4)

- T1003: OS Credential Dumping
- T1056: Input Capture
- T1552: Unsecured Credentials
- T1555: Credentials from Password Stores

### 10. Looking around (20)

- T1007: System Service Discovery
- T1010: Application Window Discovery
- T1012: Query Registry
- T1016: System Network Configuration Discovery
- T1018: Remote System Discovery
- T1033: System Owner/User Discovery
- T1046: Network Service Discovery
- T1049: System Network Connections Discovery
- T1057: Process Discovery
- T1069: Permission Groups Discovery
- T1082: System Information Discovery
- T1083: File and Directory Discovery
- T1087: Account Discovery
- T1120: Peripheral Device Discovery
- T1124: System Time Discovery
- T1217: Browser Information Discovery
- T1497: Virtualization/Sandbox Evasion
- T1518: Software Discovery
- T1614: System Location Discovery
- T1654: Log Enumeration

### 11. Spreading (2)

- T1021: Remote Services
- T1570: Lateral Tool Transfer

### 12. Gathering data (5)

- T1005: Data from Local System
- T1056: Input Capture
- T1074: Data Staged
- T1113: Screen Capture
- T1560: Archive Collected Data

### 13. Keeping contact (6)

- T1071: Application Layer Protocol
- T1090: Proxy
- T1095: Non-Application Layer Protocol
- T1105: Ingress Tool Transfer
- T1571: Non-Standard Port
- T1573: Encrypted Channel

### 14. Taking data out (0)

- None linked in public reporting.

### 15. Causing damage (0)

- None linked in public reporting.

## Public reports about Volt Typhoon

- https://www.secureworks.com/blog/chinese-cyberespionage-group-bronze-silhouette-targets-us-government-and-defense-organizations
- https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/
- https://unit42.paloaltonetworks.com/volt-typhoon-threat-brief/
- https://www.dragos.com/threat/voltzite/

## Frequently asked questions

### Who is Volt Typhoon?

Volt Typhoon is a threat group thought to operate from China. Public reporting links it to 64 attack techniques.

### Where is Volt Typhoon thought to be based?

Public reporting places Volt Typhoon as operating from China. Attribution is never certain: it rests on the tools, infrastructure and targets researchers have seen.

### How does Volt Typhoon attack?

Public reporting links Volt Typhoon to 64 attack techniques. Most of them are about looking around, hiding and research.

### How do I know if Volt Typhoon is a risk to my business?

Create an account and tell us the software you run. We match it against known flaws, including those linked to threat groups, rank each one from 0 to 100 and tell you as soon as we spot something that affects you.

## Check whether it matters to your business

A free EdgeProtect account (no card needed) matches the software you run against known flaws, including those linked to threat groups, ranks each one from 0 to 100 and tells you as soon as we spot something that affects you. It also shows which threat groups and ransomware gangs are hitting your sector, with profiles of over 900 groups and a PDF dossier for each.

- Start free: https://www.edgeprotect.io/register
- Book a demo: https://www.edgeprotect.io/contact