APT GroupSOCRadar source-of-truth import; pending cross-source consensus confidenceSynced actor recordProfile updated Aug 05, 2025, 11:56 PM EDT

Volt Typhoon

Volt Typhoon is a state-sponsored cyber threat actor affiliated with the People's Republic of China, first observed active in mid-2021. This group distinguishes itself by primarily focusing on pre-positioning capabilities within critical infrastructure networks, particularly in the United States, to enable disruptive or destructive cyberattacks during potential future geopolitical crises rather than traditional espionage or intelligence gathering. Their operational approach heavily relies on stealth through extensive use of living-off-the-land techniques and the leveraging of compromised small office/home office (SOHO) network devices, allowing them to maintain long-term, undetected persistence within target environments for years. Volt Typhoon is also tracked under various aliases including VANGUARD PANDA, BRONZE SILHOUETTE, Dev-0391, UNC3236, Voltzite, Insidious Taurus, and Storm-0391.

This profile is generated from the same canonical actor-card record used by the Threat Actor Cards directory, so aliases, targeting fields, activity notes, and source links stay aligned as the database is enriched.

Actor Card Detail

Canonical Profile Fields

Entity Type^1,2

APT Group profile

First Seen^1,2

2021-07-01

Last Seen^1,2

2025-12-31

Profile Updated^1,2

Aug 05, 2025, 11:56 PM EDT

Victim Count¹

Not available

Origin^1,2

Unknown

Motivation^1,2

Information theft and espionage

Primary Access Pattern^1,2

T1003 - OS Credential Dumping

Objective^1,2

Information theft and espionage

Identity

Aliases And Boundaries

Aliases^1,2

BRONZE SILHOUETTEDev-0391Insidious TaurusStorm-0391UNC3236VANGUARD PANDAVOLTZITEVolt TyphoonDazedToad

Source Boundary

SOCRadar is the retained baseline for this profile. IntelliOS preserves source labels as discovery and comparison signals until a cited source explicitly supports a merge, split, or actor-boundary change.

Targeting

Targets, Activity, And ATT&CK

Target Countries / Exposure¹

Not available

Target Sectors¹

Energy & UtilitiesConstructionManufacturingTransportation&WarehousingEducational ServicesOtherPublic AdministrationTelecommunicationsMuseums, Historical Sites, and Similar InstitutionsComputer Systems Design and Related ServicesPublic Relations AgenciesComputer Systems Design ServicesTour OperatorsNational SecurityConstruction of BuildingsFood ManufacturingSoftware PublishersHospitalsAccommodationAir TransportationWholesale TradeInternet PublishingPharmaceutical and Medicine ManufacturingBusiness Schools and Computer and Management TrainingIndependent Artists, Writers, and PerformersOther Amusement and Recreation IndustriesOther Personal ServicesGrantmaking and Giving ServicesJustice, Public Order, and Safety ActivitiesSemiconductor and Other Electronic Component ManufacturingNewspaper PublishersPeriodical PublishersData Processing, Hosting, and Related ServicesLibraries and ArchivesPortfolio ManagementEngineering ServicesEmployment Placement Agencies and Executive Search ServicesInvestigation, Guard, and Armored Car ServicesTruck&Rail TransportationSea TransportationInformation ServicesBankingFinanceOffices of Certified Public AccountantsOffices of Lawyers

Associated Activity^1,2

Initial Access: Exploitation of vulnerabilities in public-facing network appliances (Fortinet, Ivanti, NETGEAR, Citrix, Cisco, Zoho ManageEngine) or use of weak/insecurely stored credentials.Command and Control: Use of compromised SOHO routers as multi-hop proxies for C2 traffic, or presence of Impacket and Fast Reverse Proxy (FRP) in the environment.Discovery and Credential Access: Execution of legitimate Windows utilities such as netsh, wmic, ntdsutil, PowerShell, ipconfig, netstat, ping, reg query for reconnaissance and credential collection, particularly the extraction of NTDS.dit via vssadmin or ntdsutil.Persistence and Defense Evasion: Presence of custom web shells (e.g., Awen, VersaMem, AuditReport, iisstart.aspx), targeted log deletion, or observed usage of KV Botnet malware.Lateral Movement: Lateral movement using Remote Desktop Protocol (RDP) with valid, often stolen, credentials.

ATT&CK IDs^1,2

T1003 - OS Credential DumpingT1003.001T1003.003T1005T1006T1007T1010T1011 - Exfiltration Over Other Network MediumT1012T1016T1016.001T1018T1020 - Automated ExfiltrationT1021 - Remote ServicesT1021.001T1027T1027.002T1033T1036T1036.004T1036.005T1036.008T1040 - Network SniffingT1046T1047T1048T1049T1055T1055.009T1056T1056.001T1057T1059T1059.001 - PowerShellT1059.003T1059.004T1068 - Exploitation for Privilege EscalationT1069T1069.001T1069.002T1070T1070.001T1070.004T1070.007T1071 - Application Layer ProtocolT1071.001 - Web ProtocolsT1074T1074.001T1078 - Valid AccountsT1078.002T1082T1083T1087T1087.001T1087.002T1090 - ProxyT1090.001T1090.003T1095T1102 - Web ServiceT1105T1106T1110T1112T1113T1120T1124T1133 - External Remote ServicesT1136.001T1140 - Deobfuscate/Decode Files or InformationT1190 - Exploit Public-Facing ApplicationT1195T1199T1205.002T1210T1217T1218T1222T1222.002T1490T1497T1497.001T1505 - Server Software ComponentT1505.003T1518T1518.001T1530T1531T1546T1547T1552T1552.004T1553T1555T1555.003T1557 - Man-in-the-MiddleT1560T1560.001T1562T1562.001T1564T1564.013T1566.001T1569T1570T1571T1573T1573.001T1573.002T1583T1583.003T1583.005T1584 - Compromise InfrastructureT1584.003T1584.004T1584.005T1584.008T1587T1587.001T1587.004T1588T1588.002T1588.006T1589T1589.002T1590T1590.004T1590.006T1591T1591.004T1592T1593T1594T1595T1595.002T1596T1596.005T1614T1654T1680T1685T1685.005

Campaign Context

Associated Campaigns / Operations

Campaign / Operation	Source-Backed Context
Versa Director Zero Day Exploitation²	Versa Director Zero Day Exploitation (C0039) is attributed to Volt Typhoon (G1017) by MITRE ATT&CK Campaigns.
KV Botnet Activity²	KV Botnet Activity (C0035) is attributed to Volt Typhoon (G1017) by MITRE ATT&CK Campaigns.

Indicators

IOCs And Observable Retention

SOCRadar reported 44¹IntelliOS retained 55^4,5,6,2

SOCRadar reports 44 IOCs for this profile. IntelliOS currently retains 54 cited public observable/context rows; this is not the full possible public-source IOC corpus.

Source coverage: 5 source groups tracked; 4 currently contribute retained observable or context rows.

Retained Observables

Showing 55 of 55

Type	Value	Source
SHA-256 Hash	17506c2246551d401c43726bdaec800f8d41595d01311cf38a19140ad32da2f4⁴	Microsoft
SHA-256 Hash	389a497f27e1dd7484325e8e02bbdf656d53d5cf2601514e9b8d8974befddf61⁴	Microsoft
SHA-256 Hash	3a9d8bb85fbcfe92bae79d5ab18e4bca9eaf36cea70086e8d1ab85336c83945f⁵	CISA
SHA-256 Hash	3c2fe308c0a563e06263bbacf793bbe9b2259d795fcc36b953793a7e499e7f71⁵	CISA
SHA-256 Hash	3e9fc13fab3f8d8120bd01604ee50ff65a40121955a4150a6d2c007d34807642⁴	Microsoft
SHA-256 Hash	41e5181b9553bbe33d91ee204fe1d2ca321ac123f9147bb475c0ed32f9488597⁵	CISA
SHA-256 Hash	450437d49a7e5530c6fb04df2e56c3ab1553ada3712fab02bd1eeb1f1adbc267⁴	Microsoft
SHA-256 Hash	472ccfb865c81704562ea95870f60c08ef00bcd2ca1d7f09352398c05be5d05d⁴	Microsoft
SHA-256 Hash	472ccfb865c81704562ea95870f60c08ef00bcd2ca1d7f09352398c05be5d05d⁵	CISA
SHA-256 Hash	4b0c4170601d6e922cf23b1caf096bba2fade3dfcf92f0ab895a5f0b9a310349⁴	Microsoft
SHA-256 Hash	6036390a2c81301a23c9452288e39cb34e577483d121711b6ba6230b29a3c9ff⁴	Microsoft
SHA-256 Hash	66a19f7d2547a8a85cee7a62d0b6114fd31afdee090bd43f36b89470238393d7⁵	CISA
SHA-256 Hash	7939f67375e6b14dfa45ec70356e91823d12f28bbd84278992b99e0d2c12ace5⁴	Microsoft
SHA-256 Hash	8fa3e8fdbaa6ab5a9c44720de4514f19182adc0c9c6001c19cf159b79c0ae9c2⁴	Microsoft
SHA-256 Hash	93ce3b6d2a18829c0212542751b309dacbdc8c1d950611efe2319aa715f3a066⁴	Microsoft
SHA-256 Hash	99b80c5ac352081a64129772ed5e1543d94cad708ba2adc46dc4ab7a0bd563f1⁶	CISA
SHA-256 Hash	9dd101caee49c692e5df193b236f8d52a07a2030eed9bd858ed3aaccb406401a⁴	Microsoft
SHA-256 Hash	b4f7c5e3f14fb57be8b5f020377b993618b6e3532a4e1eb1eae9976d4130cc74⁴	Microsoft
SHA-256 Hash	baeffeb5fdef2f42a752c65c2d2a52e84fb57efc906d981f89dd518c314e231c⁴	Microsoft
SHA-256 Hash	c0fc29a52ec3202f71f6378d9f7f9a8a3a10eb19acb8765152d758aded98c76d⁴	Microsoft
SHA-256 Hash	c4b185dbca490a7f93bc96eefb9a597684fdf532d5a04aa4d9b4d4b1552c283b⁴	Microsoft
SHA-256 Hash	c7fee7a3ffaf0732f42d89c4399cbff219459ae04a81fc6eff7050d53bd69b99⁵	CISA
SHA-256 Hash	cd69e8a25a07318b153e01bba74a1ae60f8fc28eb3d56078f448461400baa984⁴	Microsoft
SHA-256 Hash	d17317e1d5716b09cee904b8463a203dc6900d78ee2053276cc948e4f41c8295⁴	Microsoft
SHA-256 Hash	d6ab36cb58c6c8c3527e788fc9239d8dcc97468b6999cf9ccd8a815c8b4a80af⁴	Microsoft
SHA-256 Hash	d6ebde42457fe4b2a927ce53fc36f465f0000da931cfab9b79a36083e914ceca⁵	CISA
SHA-256 Hash	e453e6efc5a002709057d8648dbe9998a49b9a12291dee390bb61c98a58b6e95⁴	Microsoft
SHA-256 Hash	edc0c63065e88ec96197c8d7a40662a15a812a9583dc6c82b18ecd7e43b13b70⁶	CISA
SHA-256 Hash	ee8df354503a56c62719656fae71b3502acf9f87951c55ffd955feec90a11484⁵	CISA
SHA-256 Hash	ef09b8ff86c276e9b475a6ae6b54f08ed77e09e169f7fc0872eb1d427ee27d31⁵	CISA
SHA-256 Hash	f4dd44bc19c19056794d29151a5b1bb76afd502388622e24c863a8494af147dd⁵	CISA
SHA-256 Hash	fe95a382b4f879830e2666473d662a24b34fccf34b6b3505ee1b62b32adafa15⁵	CISA
Tool / Process	custom Fast Reverse Proxy (FRP)⁴	Microsoft
Tool / Process	EarthWorm⁴	Microsoft
Tool / Process	Impacket⁴	Microsoft
Tool / Process	living-off-the-land techniques⁶	CISA
Tool / Process	LOLBins⁶	CISA
Tool / Process	netsh⁴	Microsoft
Tool / Process	network appliance compromise⁶	CISA
Tool / Process	Ntdsutil⁴	Microsoft
Tool / Process	ping⁴	Microsoft
Tool / Process	PowerShell⁴	Microsoft
Tool / Process	router and firewall footholds⁶	CISA
Tool / Process	systeminfo⁴	Microsoft
Tool / Process	valid accounts⁶	CISA
Tool / Process	wevtutil⁴	Microsoft
Tool / Process	wmic⁴	Microsoft
CVE	CVE-2021-27860⁵	CISA
CVE	CVE-2021-40539⁵	CISA
CVE	CVE-2022-42475⁶	CISA
CVE	CVE-2024-39717²	MITRE
Campaign Context	CISA and partner agencies warned that PRC state-sponsored actors living off the land can evade endpoint detection and blend into normal Windows and network-administration activity.⁵	CISA
Campaign Context	CISA's 2024 joint advisory assessed that PRC state-sponsored actors compromised and maintained persistent access to U.S. critical infrastructure, with emphasis on long-term disruptive potential and identity/network telemetry review.⁶	CISA
Campaign Context	Microsoft reported Volt Typhoon targeting U.S. critical infrastructure using living-off-the-land techniques and custom Fast Reverse Proxy variants to evade detection.⁴	Microsoft
Campaign Context	MITRE ATT&CK tracks Volt Typhoon / G1017 with aliases including BRONZE SILHOUETTE, Vanguard Panda, DEV-0391, UNC3236, Voltzite, Insidious Taurus, and DazedToad.²	MITRE

Source	Reported	Retained	Coverage Status
SOCRadar¹	44	0	Reported IOC count retained; underlying SOCRadar feed values are not republished unless stored as cited public observables.
Microsoft Threat Intelligence⁴	N/A	30	Public observables or source-context rows retained and displayed.
CISA⁵	N/A	14	Public observables or source-context rows retained and displayed.
CISA⁶	N/A	9	Public observables or source-context rows retained and displayed.
MITRE ATT&CK²	N/A	2	Public observables or source-context rows retained and displayed.

IntelliOS Intel Products

Linked Products

PANDA Flash Threat Intel Brief

Versa Director Zero Day Exploitation

Source-backed brief for MITRE C0039, CVE-2024-39717, CISA KEV context, VersaMem, and provider trust-path scoping.

CARDS Campaign

Versa Director Zero Day Exploitation Campaign Card

Canonical campaign record for Volt Typhoon's Versa Director exploitation activity.

Source Integrity AppendixSource reconciliation, citations, and collision-boundary analysisOpen

Source Reconciliation

How IntelliOS Keeps The Labels Straight

Source	Primary Name	Treatment	Boundary
SOCRadar	Volt Typhoon	Baseline actor-card record retained for the current profile view.	Fields reflect the retained database record. Additional source consensus, collisions, and canonical identity mappings can be layered into this profile without automatically merging actors.
IntelliOS	Volt Typhoon	Normalizes this record for directory search, card display, profile lookup, and future product linking.	Normalization is a presentation and workflow aid; it is not an independent attribution claim.

Open retained source profile

Citations

Source Notes

#	Source	Use In Card
1	SOCRadar Threat Actor Database https://socradar.io/free-tools/threat-actor	Baseline actor-card corpus source for retained profile fields.
2	MITRE ATT&CK https://attack.mitre.org/groups/G1017	Canonical ATT&CK group, campaign, software, aliases, and technique mapping source where matched.
3	MITRE CTI https://raw.githubusercontent.com/mitre/cti/master/enterprise-attack/enterprise-attack.json	Open MITRE CTI source used for ATT&CK enrichment.
4	Microsoft: Volt Typhoon Targets US Critical Infrastructure https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/	Vendor Research
5	CISA: PRC State-Sponsored Cyber Actor Living off the Land https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-144a	Government Advisory
6	CISA: PRC Actors Maintain Persistent Access to U.S. Critical Infrastructure https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-038a	Government Advisory

Source Collision Notes

Open Interpretation Boundaries

IntelliOS starts this detail page from the retained source record for Volt Typhoon.

No possible same-actor, alias reuse, sub-cluster, duplicate-boundary, or external-source collision is currently retained for this actor.

Collision Source	Candidate Records	Shared Evidence	Treatment
None retained	No candidate records	No shared evidence recorded	No collision action needed.
External sources	Mandiant, CrowdStrike, other non-SOCRadar sources	None retained	External collisions are shown separately when retained.

Loading Threat Actor Cards