Threat Actor ProfileVolt Typhoon

At the time of writing, there are no publicly confirmed or formally attributed intrusions by Volt Typhoon against Dutch organisations. The absence of public attribution should not be interpreted as evidence that Dutch entities fall outside the group's operational scope. Public reporting links Volt Typhoon to long-term espionage operations targeting critical infrastructure and strategically significant industries in the United States and allied countries, including the United Kingdom and Australia. These operations emphasise access maintenance and internal reconnaissance, suggesting objectives related to strategic positioning rather than immediate operational impact. This targeting logic is not geographically bound but instead prioritises organisations that play a role in interconnected international systems such as logistics, communications, energy distribution, and industrial supply chains.

The Netherlands occupies a central position within these systems due to its role as a hub for European logistics, maritime transport, digital connectivity, and industrial production. The Port of Rotterdam (the largest port in Europe) and Amsterdam Internet Exchange (AMS-IX) (one of the world's largest internet exchange points) represent exactly the kind of strategically significant infrastructure that Volt Typhoon has demonstrably targeted elsewhere. National threat assessments have explicitly warned of sustained interest by state-linked actors, including those affiliated with China, in Dutch economic, technological, and infrastructure assets, particularly where access could have broader international consequences. The AIVD's 2025 threat assessment specifically identified Chinese state-sponsored cyber actors as among the most significant and persistent threats facing the Netherlands, noting a pattern of targeting that aligns closely with Volt Typhoon's observed operational focus. While these assessments do not attribute specific incidents to Volt Typhoon by name, they describe a threat landscape that closely aligns with the group's observed targeting patterns in other countries.

Attribution challenges further complicate detection in this context. Volt Typhoon's reliance on valid accounts and trusted network paths means that intrusions may be detected as anomalous behaviour without being conclusively linked to a specific threat actor. In practice, organisations may identify credential misuse or suspicious internal activity without being able to determine whether it is associated with Volt Typhoon or another APT.

From a defensive perspective, this uncertainty should be viewed as a call to action. Volt Typhoon's operations demonstrate that malicious activity can often be detected at the behavioural level even when attribution remains unclear. Given the broader strategic context, the Netherlands' position as a critical node in European and global infrastructure, and the documented involvement of Chinese state-sponsored actors in operations targeting comparable environments, Volt Typhoon remains a relevant and credible threat to the Dutch threat landscape despite the lack of publicly confirmed cases.

Volt Typhoon's activity reflects a broader evolution in state-sponsored cyber operations, in which long-term access and strategic positioning take precedence over short-term disruption or demonstrative attacks. Rather than pursuing immediate operational effects, the group's campaigns emphasise persistence, internal reconnaissance, and the maintenance of covert access to environments of strategic relevance. The group demonstrates sustained interest in civilian and commercial infrastructure with broader systemic importance. This targeting approach mirrors warnings from Western intelligence services regarding cyber-enabled pre-positioning by state-backed actors intended to provide strategic leverage during periods of heightened geopolitical tension. This approach aligns with a growing trend among advanced state-backed actors to treat cyber operations as a preparatory capability integrated into wider geopolitical and national security planning.

A defining characteristic of this trend is the deliberate minimisation of unique tooling. Volt Typhoon's reliance on valid accounts, native system utilities, and living-off-the-land techniques mirrors tradecraft increasingly observed across multiple Chinese state-linked cyber operations. By avoiding custom malware and overt command-and-control infrastructure, the group reduces attribution confidence and extends dwell time in complex enterprise environments. This approach is not unique to Volt Typhoon but reflects a broader doctrinal shift across PRC-affiliated threat actors toward operationally disciplined, low-noise intrusion tradecraft.

Within this context, Volt Typhoon is best understood as part of a broader ecosystem of Chinese state-sponsored cyber capability. While the group exhibits its own operational patterns, significant overlap exists with other PRC-aligned intrusion clusters at the level of access methods, infrastructure abuse, and targeting logic. Analysts have noted similarities between Volt Typhoon and other China-linked threat groups that emphasise credential abuse and stealthy persistence, suggesting coordination at a doctrinal or organisational level rather than coincidental tactical overlap.

This ecosystem-based view is further illustrated by reporting on the exploitation of multiple zero-day vulnerabilities in Ivanti Connect Secure appliances in late 2023 and early 2024. During this activity, several Chinese espionage clusters were observed exploiting the same vulnerabilities — specifically CVE-2023-46805 and CVE-2024-21887 — for initial access while displaying distinct post-compromise behaviour, suggesting parallel operations by related but separately managed threat clusters. One such cluster, UNC5135, has been assessed with moderate confidence to be linked to UNC3236, which is in turn suspected to align with publicly reported Volt Typhoon activity. This assessment should be treated as tentative rather than confirmed, given the moderate confidence level of the underlying attribution.