Threat Actor ProfileVolt Typhoon

Between 2022 and 2024, Volt Typhoon systematically compromised a large network of end-of-life small office and home office (SOHO) routers and network edge devices, repurposing them as a covert operational relay network. This infrastructure, later named the "KV-Botnet" by researchers at Lumen Black Lotus Labs, was used to proxy malicious traffic through legitimate-looking IP addresses, obscuring the group's origin and significantly complicating attribution efforts.^[41]

The botnet primarily consisted of compromised Cisco RV320/RV325, Netgear ProSAFE, and ASUS routers — devices that had reached end-of-life status and no longer received security patches, making them particularly susceptible to exploitation without generating alerts in the environments through which they relayed traffic.^[42]

At its peak, the KV-Botnet comprised hundreds of compromised devices, effectively creating a domestic relay network that caused Volt Typhoon's traffic to appear to originate from within the United States.^[43] This approach served a dual purpose: it reduced the likelihood that outbound connections from victim environments would be flagged as anomalous, and it made attribution to a foreign state actor significantly more difficult for both victim organisations and government investigators. The use of compromised third-party infrastructure as operational relay nodes is a documented and consistent element of Volt Typhoon's tradecraft, reflecting the group's broader emphasis on minimising forensic footprint and complicating attribution.

In January 2024, the U.S. Department of Justice and FBI announced a court-authorised operation to disrupt the botnet. FBI agents remotely accessed hundreds of the compromised routers and deleted the malicious payloads, effectively severing the devices from Volt Typhoon's command-and-control infrastructure.^[44] FBI Director Christopher Wray described the operation as targeting "a key [Chinese government] hacking operation" and noted that the routers' owners (ordinary American households and small businesses) had no knowledge their devices were being used as relay points for state-sponsored espionage. ^[45] Despite the disruption, analysts noted that the underlying capability was not permanently dismantled, as Volt Typhoon retained the ability to rebuild similar infrastructure using other vulnerable devices.^{[46; 47]}

Dragos reporting published in 2024 elevated Volt Typhoon — tracked as VOLTZITE — to one of the highest-priority threats facing the electric utility sector, distinguishing this cluster of activity from the group's broader critical infrastructure campaign by virtue of its demonstrated and specific interest in operational technology (OT) environments.^[48]

The significance of this campaign lies in the depth of access sought. Unlike IT-focused intrusions, where the primary risk is data theft or credential harvesting, OT-adjacent access introduces the possibility of physical consequences, such as disruption to power generation or distribution systems. Dragos confirmed that VOLTZITE activity extended into OT-adjacent systems within victim environments, including network management systems and historian servers that bridge IT and OT networks.^[49] Access to such systems does not require specialised OT malware; the same credential-based, living-off-the-land techniques observed in Volt Typhoon's IT intrusions are sufficient to navigate into OT-adjacent environments where network segmentation is incomplete or inconsistently enforced.

A particularly significant finding concerns the collection of Geographic Information System (GIS) data within compromised utility environments. In an energy infrastructure context, GIS data encompasses detailed spatial records of physical asset locations: the precise placement of substations, transmission lines, generation facilities, and switching equipment. The collection of this data is not consistent with passive intelligence gathering, but rather reflects a targeting methodology oriented toward understanding the physical architecture of infrastructure in sufficient detail to identify chokepoints whose disruption would have the greatest cascading effect on grid stability.^[50] This assessment is consistent with the broader characterisation of Volt Typhoon's objective by U.S. officials: the establishment of capability to disrupt or destroy critical infrastructure at a moment of geopolitical crisis, rather than the collection of intelligence as an end in itself.^[51] Within OT-adjacent environments, the group maintained its characteristic low operational tempo, conducting systematic enumeration of network topology and asset inventories while avoiding active interaction with control systems.^{[52; 53]} This behaviour is consistent with a preference for maintaining access over achieving immediate operational effects. No disruptive activity targeting OT systems has been publicly attributed to Volt Typhoon to date.

Following the public disclosure of Volt Typhoon's activity in May 2023, cybersecurity agencies anticipated that the group would attempt to re-establish access to environments from which it had been evicted. Subsequent reporting confirmed this concern.^[54]

This re-entry pattern reflects a structural characteristic of Volt Typhoon's operational model. Remediation efforts in APT intrusions typically focus on closing known access vectors and removing identified malware and the attacker from confirmed compromise locations. They frequently fail to account for the full scope of credentials harvested during the intrusion, particularly credentials collected from systems outside the primary investigation scope, or belonging to accounts not directly linked to identified indicators of compromise. Volt Typhoon's systematic credential harvesting across extended dwell times produces an authentication capability that survives the eviction of tooling and the disruption of relay infrastructure. When credential rotation is incomplete, previously harvested credentials remain valid entry points requiring no new exploitation.^{[55; 56]} This dynamic also illustrates the limits of infrastructure-focused disruption: the January 2024 KV-Botnet takedown degraded Volt Typhoon's relay capability but did not affect the credential stockpile or environmental knowledge the group had accumulated over years of access.^{[57; 58]}

Targeting during this phase largely overlapped with earlier campaigns, particularly organisations in the utilities and transportation sectors, indicating that the group prioritised the recovery of specific, strategically valuable footholds over expansion into new environments.^[59] During congressional testimony in January 2024, FBI Director Christopher Wray characterised the campaigns of Chinese hackers as preparation for potential future conflict, warning that they are pre-positioning themselves to "wreak havoc [onto critical infrastructure] and cause real-world harm".^[60]