APT Explorer

All actors

Volt Typhoon

Also reported as BRONZE SILHOUETTE, UNC3236, Insidious Taurus, Redfly, VOLTZITE and 11 other names. Linked to China by four sources.

Reports
69
Last reported
Known CVEs
89
Techniques in ATT&CK
81
Origin
China
ID
G1017
Sources
ATT&CKMISPETDAMalpediaMicrosoft
Merge evidence
33 alias matches

Reports per quarter

Dated reports, 2023 Q2 to 2026 Q3.

Techniques seen in the last two years

Show all 29 techniques Show fewer

Counts come from technique IDs in the actor's report text. “Reports only” means reports name the technique but MITRE ATT&CK® does not list it for this actor.

Also listed by ATT&CK

Show all 71 techniques Show fewer

CVEs named in reports

Show all 89 CVEs Show fewer

KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.

Reports

  1. UAT-7810 continues building ORB networks using new malware

    Malpedia library date ORKL

    Archived copy on ORKL Details

  2. CL-STA-1062 Targets Southeast Asian Governments and Critical Infrastructure

    Malpedia library date ORKL

    Archived copy on ORKL Details

  3. Introducing the 2026 Cloudflare Threat Report

    date ORKL added it ORKL

    Archived copy on ORKL Details

  4. Chinese Cyberespionage Group BRONZE SILHOUETTE Targets U.S. Government and Defense Organizations

    date ORKL added it ORKL

    The title opens Wayback Machine, not the publisher’s page. Archived copy on ORKL Details

  5. Chinese cyber agency accused of 'false and baseless' claims about US interfering in Volt Typhoon research

    date ORKL added it ORKL

    Archived copy on ORKL Details

  6. China Accuses U.S. of Fabricating Volt Typhoon to Hide Its Own Hacking Campaigns

    date ORKL added it ORKL

    Archived copy on ORKL Details

  7. ShadowPad (Malware Family)

    date ORKL added it ORKL

    The title opens a link whose publisher is not confirmed. Archived copy on ORKL Details

  8. Mandiant Intelligence Chief Raises Alarm Over China’s ‘Volt Typhoon’ Hackers in US Critical Infrastructure

    date ORKL added it ORKL

    Archived copy on ORKL Details

  9. Singapore accuses Chinese state-backed hackers of attacking critical infrastructure networks

    date ORKL added it ORKL

    Archived copy on ORKL Details

  10. China's Volt Typhoon APT Burrows Deeper Into US Critical Infrastructure

    date ORKL added it ORKL

    Archived copy on ORKL Details

Show all 69 reports Show fewer

  1. The Importance of Patching: An Analysis of the Exploitation of N-Day Vulnerabilities | Fortinet Blog

    date ORKL added it ORKL

    Archived copy on ORKL Details

  2. Chinese group accused of hacking Singtel in telecom attacks

    date ORKL added it ORKL

    Archived copy on ORKL Details

  3. NSA: Volt Typhoon was ‘not successful’ at persisting in critical infrastructure

    date ORKL added it ORKL

    Archived copy on ORKL Details

  4. Cybereason Blog | Cybersecurity News and Analysis

    date ORKL added it ORKL

    Archived copy on ORKL Details

  5. China Admitted to Volt Typhoon Cyberattacks on US Critical Infrastructure: Report

    date ORKL added it ORKL

    Archived copy on ORKL Details

  6. Analysis of CVE-2023-27997 and Clarifications on Volt Typhoon Campaign | Fortinet Blog

    date ORKL added it ORKL

    Archived copy on ORKL Details

  7. Meterpreter (Malware Family)

    date ORKL added it ORKL

    The title opens a link whose publisher is not confirmed. Archived copy on ORKL Details

  8. The MITRE ATT&CK T1003 OS Credential Dumping Technique and Its Adversary Use

    date ORKL added it ORKL

    Archived copy on ORKL Details

  9. US agencies confirm Beijing-linked telecom breach involving call records of politicians, wiretaps

    date ORKL added it ORKL

    Archived copy on ORKL Details

  10. APT and financial attacks on industrial organizations in H1 2023 | Kaspersky ICS CERT EN

    date ORKL added it ORKL

    Archived copy on ORKL Details

  11. LaZagne (Malware Family)

    date ORKL added it ORKL

    The title opens a link whose publisher is not confirmed. Archived copy on ORKL Details

  12. Volt Typhoon - Threat Group Cards: A Threat Actor Encyclopedia

    date ORKL added it ORKL

    The title opens a link whose publisher is not confirmed. Archived copy on ORKL Details

  13. MimiKatz (Malware Family)

    date ORKL added it ORKL

    The title opens a link whose publisher is not confirmed. Archived copy on ORKL Details

  14. Beijing accused of misusing Western research to claim Volt Typhoon is a ransomware group

    date ORKL added it ORKL

    Archived copy on ORKL Details

  15. Cybereason Blog | Cybersecurity News and Analysis

    date ORKL added it ORKL

    Archived copy on ORKL Details

  16. Volt Typhoon's future war

    date ORKL added it ORKL

    Archived copy on ORKL Details

  17. Salt Typhoon: An Analysis of Vulnerabilities Exploited by this State-Sponsored Actor

    date ORKL added it ORKL

    Archived copy on ORKL Details

  18. 2026_YIR_ExecutiveBriefing%20O_G.pdf?hsLang=en

    file creation date ORKL

    Archived copy on ORKL Details

  19. Threats to the Defense Industrial Base

    Malpedia library date ORKL

    Archived copy on ORKL Details

  20. UAT-7237 targets Taiwanese web hosting infrastructure

    Malpedia library date ORKL

    Archived copy on ORKL Details

  21. Will the Real Salt Typhoon Please Stand Up?

    Malpedia library date ORKL

    Archived copy on ORKL Details

  22. LapDogs-STRIKE-Report-June-2025.pdf

    Malpedia library date ORKL

    Archived copy on ORKL Details

  23. UAT-5918 targets critical infrastructure entities in Taiwan

    Malpedia library date ORKL

    Archived copy on ORKL Details

  24. Ghost in the Router: China-Nexus Espionage Actor UNC3886 Targets Juniper Routers

    Malpedia library date ORKL

    Archived copy on ORKL Details

  25. Dragos_Littleton_Electric_Water_CaseStudy.pdf

    file creation date ORKL

    The original link failed its last check. Original publisher Details

  26. Will the Real Volt Typhoon Please Stand Up?

    Malpedia library date ORKL

    Archived copy on ORKL Details

  27. Justice Department and FBI Conduct International Operation to Delete Malware Used by China-Backed Hackers

    Malpedia library date ORKL

    Archived copy on ORKL Details

  28. Spot the Difference: Earth Kasha's New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella

    Malpedia library date ORKL

    Archived copy on ORKL Details

  29. Threat Actor Groups Tracked by Palo Alto Networks Unit 42 (Updated Aug. 1, 2025)

    Malpedia library date ORKL

    Archived copy on ORKL Details

  30. Asia-24-Chen-Chinese-APT.pdf

    Malpedia library date ORKL

    Archived copy on ORKL Details

  31. Cutting Edge, Part 4: Ivanti Connect Secure VPN Post-Exploitation Lateral Movement Case Studies

    Malpedia library date ORKL

    Archived copy on ORKL Details

  32. Cutting Edge, Part 4: Ivanti Connect Secure VPN Post-Exploitation Lateral Movement Case Studies

    Malpedia library date ORKL

    Archived copy on ORKL Details

  33. APT and financial attacks on industrial organizations in H2 2023 | Kaspersky ICS CERT EN

    Malpedia library date ORKL

    Archived copy on ORKL Details

  34. Microsoft Security Compliance and Identity

    Malpedia library date ORKL

    Archived copy on ORKL Details

  35. PRC State-Sponsored Cyber Activity: Actions for Critical Infrastructure Leaders

    file creation date ORKL

    Archived copy on ORKL Details

  36. aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf

    file creation date ORKL

    Archived copy on ORKL Details

  37. Dragos_IntelBrief_VOLTZITE_FINAL.pdf

    file creation date ORKL

    Archived copy on ORKL Details

  38. PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure | CISA

    Malpedia library date ORKL

    Archived copy on ORKL Details

  39. MAR-10448362-1.v1 Volt Typhoon | CISA

    Malpedia library date ORKL

    Archived copy on ORKL Details

  40. KV-botnet: Don't call it a comeback

    Malpedia library date ORKL

    Archived copy on ORKL Details

  41. U.S. Government Disrupts Botnet People’s Republic of China Used to Conceal Hacking of Critical Infrastructure

    Malpedia library date ORKL

    Archived copy on ORKL Details

  42. PowerPoint 簡報

    Malpedia library date TeamT5 ORKL

    Archived copy on ORKL Details

  43. Volt-Typhoon.pdf

    Malpedia library date ORKL

    Archived copy on ORKL Details

  44. Routers roasting on an open firewall: The KV-botnet investigation

    Malpedia library date ORKL

    Archived copy on ORKL Details

  45. Microsoft shares threat intelligence at CYBERWARCON 2023 | Microsoft Security Blog

    Malpedia library date ORKL

    Archived copy on ORKL Details

  46. Rewterz Threat Alert - Power Supplier’s Network Infiltrated for 6 Months by “Redfly” Hackers – Active IOCs - Rewterz

    Malpedia library date ORKL

    Archived copy on ORKL Details

  47. 2023 State of The Threat – A Year in Review

    Malpedia library date Secureworks ORKL

    Archived copy on ORKL Details

  48. Redfly: Espionage Actors Continue to Target Critical Infrastructure

    Malpedia library date ORKL

    Archived copy on ORKL Details

  49. My Tea’s not cold. An overview of China’s cyber threat

    Malpedia library date ORKL

    Archived copy on ORKL Details

  50. Stealth Mode: Chinese Cyber Espionage Actors Continue to Evolve Tactics to Avoid Detection | Mandiant

    Malpedia library date ORKL

    Archived copy on ORKL Details

  51. Business as Usual: Falcon Complete MDR Thwarts Novel VANGUARD PANDA (Volt Typhoon) Tradecraft

    Malpedia library date ORKL

    Archived copy on ORKL Details

  52. Picus Cyber Threat Intelligence Report May 2023: Top 10 MITRE ATT&CK Techniques

    Malpedia library date ORKL

    Archived copy on ORKL Details

  53. CSA_Living_off_the_Land.PDF

    file creation date ORKL

    Archived copy on ORKL Details

  54. Threat Brief: Attacks on Critical Infrastructure Attributed to Insidious Taurus (Volt Typhoon)

    Malpedia library date ORKL

    Archived copy on ORKL Details

  55. Chinese Cyberespionage Group BRONZE SILHOUETTE Targets U.S. Government and Defense Organizations

    date in the title ORKL

    The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Details

  56. Volt Typhoon targets US critical infrastructure with living-off-the-land techniques | Microsoft Security Blog

    Malpedia library date ORKL

    Archived copy on ORKL Details

  57. Volt Typhoon targets US critical infrastructure with living-off-the-land techniques _ Microsoft Security Blog

    date in the CCS '25 data Microsoft ORKLCCS '25 data

    The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Details

  58. Volt Typhoon targets US critical infrastructure with living-off-the-land techniques

    date in the title ORKL

    The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Details

  59. AA23-144a- People's Republic of China State-Sponsored Cyber Actor Living off the Land to Evade Detection

    date in the title ORKL

    The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Details

Newest first. Details opens the report in Explore.