Volt Typhoon - Threat Group Cards: A Threat Actor Encyclopedia
Archived: 2026-04-05 16:30:37 UTC
 APT group: Volt Typhoon
Names
Volt Typhoon (Microsoft)
Vanguard Panda (CrowdStrike)
Bronze Silhouette (SecureWorks)
Redfly (Symantec)
Insidious Taurus (Palo Alto)
VOLTZITE (Dragos)
Dev-0391 (Microsoft)
Storm-0391 (Microsoft)
UNC3236 (Mandiant)
UAT-5918 (Talos)
UAT-7237 (Talos)
Country China
Sponsor State-sponsored
Motivation Information theft and espionage
First seen 2020
Description (Microsoft) Microsoft has uncovered stealthy and targeted malicious activity focused on
post-compromise credential access and network system discovery aimed at critical
infrastructure organizations in the United States. The attack is carried out by Volt
Typhoon, a state-sponsored actor based in China that typically focuses on espionage and
information gathering. Microsoft assesses with moderate confidence that this Volt
Typhoon campaign is pursuing development of capabilities that could disrupt critical
communications infrastructure between the United States and Asia region during future
crises.
Volt Typhoon has been active since mid-2021 and has targeted critical infrastructure
organizations in Guam and elsewhere in the United States. In this campaign, the affected
organizations span the communications, manufacturing, utility, transportation,
construction, maritime, government, information technology, and education sectors.
Observed behavior suggests that the threat actor intends to perform espionage and
maintain access without being detected for as long as possible. Microsoft is choosing to
highlight this Volt Typhoon activity at this time because of our significant concern
around the potential for further impact to our customers. Although our visibility into
https://apt.etda.or.th/cgi-bin/showcard.cgi?u=a8b73194-0ca4-41b0-85ff-3793b83e47c0
Page 1 of 4

these threats has given us the ability to deploy detections to our customers, the lack of
visibility into other parts of the actor’s activity compelled us to drive broader community
awareness and further investigations and protections across the security ecosystem.
Observed
Sectors: Construction, Education, Energy, Government, Industrial, IT, Maritime and
Shipbuilding, Manufacturing, Telecommunications, Transportation, Utilities.
Countries: Australia, Canada, India, Singapore, Taiwan, UK, USA.
Tools used FRP, Impacket, Living off the Land.
Operations performed
Jun 2021
Chinese Cyberespionage Group BRONZE SILHOUETTE Targets U.S.
Government and Defense Organizations
Feb 2022
Routers Roasting on an Open Firewall: the KV-botnet Investigation
2023
Hunting Active Threats in Littleton’s Grid with the Dragos Platform and
OT Watch
2023
UAT-5918 targets critical infrastructure entities in Taiwan
Feb 2023
Redfly: Espionage Actors Continue to Target Critical Infrastructure
Jun 2023
Analysis of CVE-2023-27997 and Clarifications on Volt Typhoon
Campaign
Jun 2023
Business as Usual: Falcon Complete MDR Thwarts Novel VANGUARD
PANDA (Volt Typhoon) Tradecraft
Jul 2023
China's Volt Typhoon APT Burrows Deeper Into US Critical Infrastructure
https://apt.etda.or.th/cgi-bin/showcard.cgi?u=a8b73194-0ca4-41b0-85ff-3793b83e47c0
Page 2 of 4

Dec 2023
Volt Typhoon Compromises 30% of Cisco RV320/325 Devices in 37 Days
Dec 2023
KV-Botnet: Don’t call it a Comeback
Jun 2024
Taking the Crossroads: The Versa Director Zero-Day Exploitation
Jun 2024
Chinese group accused of hacking Singtel in telecom attacks
Aug 2025
UAT-7237 targets Taiwanese web hosting infrastructure
Counter operations Dec 2023
U.S. Government Disrupts Botnet People’s Republic of China Used to
Conceal Hacking of Critical Infrastructure
Information
Last change to this card: 16 August 2025
https://apt.etda.or.th/cgi-bin/showcard.cgi?u=a8b73194-0ca4-41b0-85ff-3793b83e47c0
Page 3 of 4

Download this actor card in PDF or JSON format
Source: https://apt.etda.or.th/cgi-bin/showcard.cgi?u=a8b73194-0ca4-41b0-85ff-3793b83e47c0
https://apt.etda.or.th/cgi-bin/showcard.cgi?u=a8b73194-0ca4-41b0-85ff-3793b83e47c0
Page 4 of 4