type: intrusion-set
spec_version: 2.1
id: intrusion-set--174279b4-399f-4ddb-966e-5efedd1dd5f2
created: 2023-07-27T20:35:46.206Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G1017
external_id: G1017
source_name: Vanguard Panda
description: (Citation: CISA AA24-038A PRC Critical Infrastructure February 2024)
source_name: DEV-0391
description: (Citation: CISA AA24-038A PRC Critical Infrastructure February 2024)
source_name: UNC3236
description: (Citation: CISA AA24-038A PRC Critical Infrastructure February 2024)
source_name: Voltzite
description: (Citation: CISA AA24-038A PRC Critical Infrastructure February 2024)
source_name: Insidious Taurus
description: (Citation: CISA AA24-038A PRC Critical Infrastructure February 2024)
source_name: BRONZE SILHOUETTE
description: (Citation: Secureworks BRONZE SILHOUETTE May 2023)(Citation: CISA AA24-038A PRC Critical Infrastructure February 2024)
source_name: CISA AA24-038A PRC Critical Infrastructure February 2024
description: CISA et al.. (2024, February 7). PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure. Retrieved May 15, 2024.
url: https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf
source_name: Secureworks BRONZE SILHOUETTE May 2023
description: Counter Threat Unit Research Team. (2023, May 24). Chinese Cyberespionage Group BRONZE SILHOUETTE Targets U.S. Government and Defense Organizations. Retrieved July 27, 2023.
url: https://www.secureworks.com/blog/chinese-cyberespionage-group-bronze-silhouette-targets-us-government-and-defense-organizations
source_name: Microsoft Volt Typhoon May 2023
description: Microsoft Threat Intelligence. (2023, May 24). Volt Typhoon targets US critical infrastructure with living-off-the-land techniques. Retrieved July 27, 2023.
url: https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/
source_name: Joint Cybersecurity Advisory Volt Typhoon June 2023
description: NSA et al. (2023, May 24). People's Republic of China State-Sponsored Cyber Actor Living off the Land to Evade Detection. Retrieved July 27, 2023.
url: https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-30T13:27:45.018Z
name: Volt Typhoon
description: [Volt Typhoon](https://attack.mitre.org/groups/G1017) is a People's Republic of China (PRC) state-sponsored actor that has been active since at least 2021 primarily targeting critical infrastructure organizations in the US and its territories including Guam. [Volt Typhoon](https://attack.mitre.org/groups/G1017)'s targeting and pattern of behavior have been assessed as pre-positioning to enable lateral movement to operational technology (OT) assets for potential destructive or disruptive attacks. [Volt Typhoon](https://attack.mitre.org/groups/G1017) has emphasized stealth in operations using web shells, living-off-the-land (LOTL) binaries, hands on keyboard activities, and stolen credentials.(Citation: CISA AA24-038A PRC Critical Infrastructure February 2024)(Citation: Microsoft Volt Typhoon May 2023)(Citation: Joint Cybersecurity Advisory Volt Typhoon June 2023)(Citation: Secureworks BRONZE SILHOUETTE May 2023)
aliases: Volt Typhoon
BRONZE SILHOUETTE
Vanguard Panda
DEV-0391
UNC3236
Voltzite
Insidious Taurus
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Ai Kimura, NEC Corporation
Manikantan Srinivasan, NEC Corporation India
Phyo Paing Htun (ChiLai), I-Secure Co.,Ltd
Pooja Natarajan, NEC Corporation India
Vlad Shumaher, Palo Alto Networks
x_mitre_domains: enterprise-attack