Threat Actor Profile
High
APT
Description
Volt Typhoon is a People's Republic of China (PRC) state-sponsored actor that has been active since at least 2021 primarily targeting critical infrastructure organizations in the US and its territories including Guam. Volt Typhoon's targeting and pattern of behavior have been assessed as pre-positioning to enable lateral movement to operational technology (OT) assets for potential destructive or disruptive attacks. Volt Typhoon has emphasized stealth in operations using web shells, living-off-the-land (LOTL) binaries, hands on keyboard activities, and stolen credentials.(Citation: CISA AA24-038A PRC Critical Infrastructure February 2024)(Citation: Microsoft Volt Typhoon May 2023)(Citation: Joint Cybersecurity Advisory Volt Typhoon June 2023)(Citation: Secureworks BRONZE SILHOUETTE May 2023)
Confidence Score
Known Aliases
Volt Typhoon
BRONZE SILHOUETTE
Vanguard Panda
DEV-0391
UNC3236
Voltzite
Insidious Taurus
Tags
mitre-attack
stix-2.1
intrusion-set
First Seen
Unknown
Last Updated
Unknown
Active Status
ActiveCreated
April 29, 2026
MITRE ATT&CK Techniques (81)
Indicators of Compromise
Loading IOCs…
IOC KQL for Sentinel
STIX Data
{'aliases': ['Volt Typhoon',
'BRONZE SILHOUETTE',
'Vanguard Panda',
'DEV-0391',
'UNC3236',
'Voltzite',
'Insidious Taurus'],
'created': '2023-07-27T20:35:46.206Z',
'created_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
'description': '[Volt Typhoon](https://attack.mitre.org/groups/G1017) is a '
"People's Republic of China (PRC) state-sponsored actor that "
'has been active since at least 2021 primarily targeting '
'critical infrastructure organizations in the US and its '
'territories including Guam. [Volt '
"Typhoon](https://attack.mitre.org/groups/G1017)'s targeting "
'and pattern of behavior have been assessed as pre-positioning '
'to enable lateral movement to operational technology (OT) '
'assets for potential destructive or disruptive attacks. [Volt '
'Typhoon](https://attack.mitre.org/groups/G1017) has '
'emphasized stealth in operations using web shells, '
'living-off-the-land (LOTL) binaries, hands on keyboard '
'activities, and stolen credentials.(Citation: CISA AA24-038A '
'PRC Critical Infrastructure February 2024)(Citation: '
'Microsoft Volt Typhoon May 2023)(Citation: Joint '
'Cybersecurity Advisory Volt Typhoon June 2023)(Citation: '
'Secureworks BRONZE SILHOUETTE May 2023)',
'external_references': [{'external_id': 'G1017',
'source_name': 'mitre-attack',
'url': 'https://attack.mitre.org/groups/G1017'},
{'description': '(Citation: CISA AA24-038A PRC '
'Critical Infrastructure February '
'2024)',
'source_name': 'Vanguard Panda'},
{'description': '(Citation: CISA AA24-038A PRC '
'Critical Infrastructure February '
'2024)',
'source_name': 'DEV-0391'},
{'description': '(Citation: CISA AA24-038A PRC '
'Critical Infrastructure February '
'2024)',
'source_name': 'UNC3236'},
{'description': '(Citation: CISA AA24-038A PRC '
'Critical Infrastructure February '
'2024)',
'source_name': 'Voltzite'},
{'description': '(Citation: CISA AA24-038A PRC '
'Critical Infrastructure February '
'2024)',
'source_name': 'Insidious Taurus'},
{'description': '(Citation: Secureworks BRONZE '
'SILHOUETTE May 2023)(Citation: CISA '
'AA24-038A PRC Critical '
'Infrastructure February 2024)',
'source_name': 'BRONZE SILHOUETTE'},
{'description': 'CISA et al.. (2024, February 7). PRC '
'State-Sponsored Actors Compromise '
'and Maintain Persistent Access to '
'U.S. Critical Infrastructure. '
'Retrieved May 15, 2024.',
'source_name': 'CISA AA24-038A PRC Critical '
'Infrastructure February 2024',
'url': 'https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf'},
{'description': 'Counter Threat Unit Research Team. '
'(2023, May 24). Chinese '
'Cyberespionage Group BRONZE '
'SILHOUETTE Targets U.S. Government '
'and Defense Organizations. Retrieved '
'July 27, 2023.',
'source_name': 'Secureworks BRONZE SILHOUETTE May '
'2023',
'url': 'https://www.secureworks.com/blog/chinese-cyberespionage-group-bronze-silhouette-targets-us-government-and-defense-organizations'},
{'description': 'Microsoft Threat Intelligence. '
'(2023, May 24). Volt Typhoon targets '
'US critical infrastructure with '
'living-off-the-land techniques. '
'Retrieved July 27, 2023.',
'source_name': 'Microsoft Volt Typhoon May 2023',
'url': 'https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/'},
{'description': "NSA et al. (2023, May 24). People's "
'Republic of China State-Sponsored '
'Cyber Actor Living off the Land to '
'Evade Detection. Retrieved July 27, '
'2023.',
'source_name': 'Joint Cybersecurity Advisory Volt '
'Typhoon June 2023',
'url': 'https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF'}],
'id': 'intrusion-set--174279b4-399f-4ddb-966e-5efedd1dd5f2',
'modified': '2025-04-30T13:27:45.018Z',
'name': 'Volt Typhoon',
'object_marking_refs': ['marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168'],
'revoked': False,
'spec_version': '2.1',
'type': 'intrusion-set',
'x_mitre_attack_spec_version': '3.2.0',
'x_mitre_contributors': ['Ai Kimura, NEC Corporation',
'Manikantan Srinivasan, NEC Corporation India',
'Phyo Paing Htun (ChiLai), I-Secure Co.,Ltd',
'Pooja Natarajan, NEC Corporation India',
'Vlad Shumaher, Palo Alto Networks'],
'x_mitre_deprecated': False,
'x_mitre_domains': ['enterprise-attack'],
'x_mitre_modified_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
'x_mitre_version': '2.0'}