Volt Typhoon

Summary

Microsoft has uncovered a stealthy and targeted malicious campaign led by Volt Typhoon, a state-sponsored actor from China, with a focus on post-compromise credential access and network system discovery. Their primary targets are critical infrastructure organizations in the United States, including sectors such as communications, manufacturing, utility, transportation, construction, government, and more. The threat actor’s goal is to perform espionage, maintaining undetected access, and potentially disrupt critical communications infrastructure between the United States and Asia during future crises. This campaign relies heavily on living-off-the-land techniques, stolen credentials, and custom tools to avoid detection. Microsoft is raising awareness and sharing mitigation steps to protect organizations from these stealthy attacks, emphasizing the need to close or change compromised accounts.