Most nation-state intrusions into telecom networks follow a familiar logic: get in, collect, get out with something valuable — subscriber records, call metadata, authentication vectors. Salt Typhoon harvested CDRs. Liminal Panda intercepted SMS. Volt Typhoon breaks that pattern entirely. It doesn't appear to want data. It wants access — durable, quiet, and ready to be activated the moment it's needed.
Disclosed in May 2023 through a joint NSA/CISA/FBI advisory and parallel Microsoft threat intelligence, Volt Typhoon is a People's Republic of China state-sponsored actor that spent years embedded inside US critical infrastructure — telecommunications, energy, water, and transportation systems — without deploying a single piece of custom malware. Every action inside the compromised environment used tools that were already there: netsh, PowerShell, WMIC. The assessed objective, per US government attribution, is not espionage in the traditional sense. It's pre-positioning capability to disrupt or destroy critical infrastructure functions in the event of a major regional conflict — most pointedly, a Taiwan Strait contingency.
This is what makes Volt Typhoon one of the most consequential documented campaigns against critical infrastructure: it is a case study in how a sophisticated actor can achieve multi-year persistence inside sensitive networks while evading nearly every detection mechanism built around signature-based malware analysis, simply by never installing anything an antivirus engine would recognize as foreign.
Volt Typhoon (tracked by Microsoft as G0001/Volt Typhoon, and by Secureworks as Bronze Silhouette) has maintained access to US critical infrastructure networks since at least mid-2021, entering primarily through compromised Fortinet FortiGuard VPN appliances and hijacked small office/home office (SOHO) routers repurposed as covert proxy infrastructure. Once inside, the actor relied exclusively on living-off-the-land (LOTL) binaries — no custom implants, no unique C2 malware — to harvest credentials, map network topology, and establish long-term footholds inside telecom and adjacent OT-adjacent environments.
I. Attribution and Assessed Intent
Volt Typhoon carries a formal, high-confidence attribution to the People's Republic of China, published jointly by the NSA, CISA, and FBI in May 2023, with corroborating technical detail from Microsoft's MSTIC team the same month. This puts it in the same attribution tier as Salt Typhoon — a named, state-sponsored actor rather than an "assessed" or loosely-clustered activity group.
What separates Volt Typhoon from nearly every other actor profiled in this research series is the stated purpose behind the intrusions. US government advisories are explicit that Volt Typhoon's activity is "consistent with pre-positioning for disruptive or destructive cyberattacks against US critical infrastructure in the event of a major crisis or conflict." Targeted sectors span communications, energy, transportation systems, and water/wastewater — with telecommunications providers singled out because they carry the command-and-control backbone that both civilian continuity-of-operations and military logistics depend on during a crisis.
First observed activity traces back to mid-2021, with the campaign remaining active and undetected for a multi-year dwell time at the point of public disclosure in May 2023 — meaning the operators had, in some environments, years of quiet access before defenders knew to look for them.
II. The Entry Vector: Edge Devices, Not Endpoints
Volt Typhoon's initial access strategy deliberately avoids the parts of the network defenders watch most closely. Rather than targeting user workstations or attempting spearphishing against telecom staff, the group focuses on internet-facing edge appliances — the network perimeter devices that are frequently under-monitored, infrequently patched, and rarely subject to EDR coverage at all.
The two primary entry mechanisms documented in the advisory:
- Fortinet FortiGuard VPN exploitation. Volt Typhoon has leveraged vulnerabilities in internet-exposed Fortinet VPN appliances to gain initial network access — the same class of perimeter device that has repeatedly proven to be a soft entry point across multiple nation-state campaigns against telecom and enterprise infrastructure alike.
- SOHO router compromise for proxy infrastructure. In a technique that has since become a hallmark of Chinese state-sponsored operations, Volt Typhoon compromises small office/home office routers — the kind of commodity NETGEAR, ASUS, and similar consumer/SMB devices that are almost never centrally managed or patched — and repurposes them as a covert relay layer. Traffic destined for the real target infrastructure is routed through this chain of hijacked SOHO devices, so that when a defender at the victim telecom or utility traces an intrusion back to its source IP, they find a residential router in an unrelated country rather than PRC-controlled infrastructure.
III. Living Off the Land: Why This Evades Detection
The defining characteristic of Volt Typhoon — and the reason it stayed hidden for years — is its complete avoidance of custom malware. The toolset consists entirely of legitimate, pre-installed operating system utilities repurposed for malicious ends:
| Tool | Legitimate Purpose | Malicious Use by Volt Typhoon |
|---|---|---|
Netsh | Windows network configuration utility | Proxy/port-forwarding configuration for covert tunneling |
| PowerShell | Windows administrative scripting | Command execution, discovery, credential access operations |
| WMIC | Windows Management Instrumentation CLI | System/network discovery, remote command execution |
| FRP proxy | Open-source reverse proxy (legitimate tool, dual-use) | Covert C2 tunneling through compromised SOHO infrastructure |
| Mimikatz (limited use) | Credential-dumping research tool | Selective, minimal-footprint credential harvesting |
This approach is commonly called "living off the land" (LOTL) or LOLBins (Living-Off-the-Land Binaries) — and it is devastating against detection strategies built around signature matching, hash blocklisting, or known-malware-family classification. Antivirus and EDR products are fundamentally built to recognize foreign code; netsh.exe and powershell.exe are code the operating system vendor signed and shipped. There is no file to quarantine, no unique hash to blocklist, no malware family to attribute.
This is also precisely why the campaign maps so poorly onto the "weaponize," "install," and "command-and-control" phases as traditionally modeled in a kill chain built around custom payloads — there is no weaponization step when the weapon is cmd.exe, and no discrete "install" event distinguishable from routine system administration. That absence is itself the signal, not a gap in the intelligence.
IV. The Documented Kill Chain
Public reporting on Volt Typhoon is unusually candid about where the intelligence picture is thin. Several kill-chain phases — weaponization, a discrete installation event, and a distinguishable C2 channel — simply are not populated with the same granularity as in malware-driven campaigns like Salt Typhoon or GALLIUM. That's not an intelligence gap so much as an accurate reflection of a campaign built around native-tool abuse rather than staged payload delivery. The phases that are documented:
- Reconnaissance — Targeting of US critical infrastructure sectors, including telecommunications, for strategic pre-positioning ahead of a potential future conflict scenario. System Network Configuration Discovery (
T1016) is used extensively to map the target environment once initial access is achieved. - Delivery — Exploitation of Fortinet FortiGuard VPN vulnerabilities (
T1190— Exploit Public-Facing Application), combined with compromise of SOHO/COTS routers to build a relay layer that obscures the true origin of follow-on traffic. - Exploitation — Credential theft via native OS tooling (
T1003— OS Credential Dumping) and reuse of valid, harvested credentials (T1078— Valid Accounts) to move through the environment without triggering malware-focused detections. - Installation — Not a discrete "implant install" in the traditional sense; persistence is achieved through stolen VPN credentials, FRP proxy tunnels routed through compromised SOHO infrastructure (
T1572— Protocol Tunneling) for covert command channels, and systematic clearing of event logs and indicators (T1070— Indicator Removal) to frustrate forensic reconstruction. - Actions on Objectives — Network topology mapping and credential pre-positioning across the target environment, with an assessed end-state capability aligned to Service Stop (
T1489) — i.e., the ability to disrupt or disable services on demand, consistent with a wartime-disruption objective rather than an ongoing collection mission.
V. MITRE ATT&CK Technique Mapping
| Technique ID | Name | Tactic |
|---|---|---|
| T1190 | Exploit Public-Facing Application | Initial Access |
| T1078 | Valid Accounts | Persistence |
| T1003 | OS Credential Dumping | Credential Access |
| T1070 | Indicator Removal | Defense Evasion |
| T1572 | Protocol Tunneling | Command and Control |
| T1016 | System Network Configuration Discovery | Discovery |
| T1489 | Service Stop | Impact |
Notably absent from this mapping: any technique tied to a custom malware family, a bespoke exploit toolkit, or a proprietary C2 protocol. Every technique above is achievable with tools an administrator already has on hand — which is exactly the point.
VI. The Standards Gap: SOHO/COTS Devices Are Nobody's Responsibility
Volt Typhoon's success exposes a structural gap that no single standards body currently owns: small office/home office and commercial-off-the-shelf devices sit in a security no-man's-land. They are not covered by enterprise patch management programs, are rarely included in telecom perimeter hardening guidance, and are manufactured with consumer-grade update cadences that assume a home user, not a nation-state actor, is the threat model.
Two concrete gaps stand out:
- SOHO/COTS OT device patching. There is no equivalent of GSMA FS.11 or 3GPP TS 33.501 for the millions of consumer and small-business routers that end up embedded in — or adjacent to — critical infrastructure networks and their supply chains. Firmware update mechanisms on these devices are often manual, unsigned, or entirely absent past a device's initial support window.
- Perimeter VPN hardening. Internet-facing VPN concentrators remain a recurring initial-access vector across nation-state campaigns — the same class of device implicated in Salt Typhoon's entry into carrier management planes. CISA hardening guidance exists, but as documented across multiple campaigns in this research series, it is frequently published after exploitation rather than enforced proactively as a pre-condition for internet exposure.
VII. Mitigation and Detection Strategy
- Patch and isolate edge appliances. Fortinet and other VPN/firewall appliances facing the internet should be on the most current firmware, with management interfaces never exposed directly to the internet. Treat every internet-facing appliance as a Tier-0 asset requiring the same patch SLA as domain controllers.
- Enable comprehensive command-line and PowerShell logging. Windows Event ID 4688 with command-line auditing, plus PowerShell Script Block Logging (Event ID 4104), are the minimum telemetry required to see LOTL activity at all. Forward these to a SIEM with behavioral analytics, not just keyword alerting.
- Baseline administrative tool usage per asset class. Build detections around anomalous use of
netsh, WMIC, and PowerShell relative to each host's normal administrative pattern — unusual accounts, unusual times, unusual target hosts, or unusual command-line arguments (particularlynetsh interface portproxyconfiguration, which is rarely legitimate outside specific network engineering workflows). - Audit and replace end-of-life SOHO/COTS devices anywhere they exist in or adjacent to critical infrastructure networks, including remote-access equipment used by third-party vendors and contractors.
- Hunt for indicator removal, not just indicators of compromise. Systematic event log clearing is itself a strong detection signal — a sudden gap in expected logging from a critical asset should trigger investigation regardless of whether any other alert fired.
These same detection principles — behavioral baselining over signature matching, aggressive edge-device hardening, comprehensive administrative logging — form the backbone of the LOTL-focused red team methodology covered in our telecom penetration testing lifecycle, where Phase 1 reconnaissance and Phase 4 post-exploitation persistence techniques mirror much of what Volt Typhoon does in the wild.
VIII. Frequently Asked Questions
Unlike Salt Typhoon, GALLIUM, or Liminal Panda — all of which deployed custom malware and were primarily focused on data collection (CDRs, subscriber location, SMS content) — Volt Typhoon uses exclusively living-off-the-land techniques with no custom malware, and its assessed objective is disruptive pre-positioning for a future conflict rather than ongoing espionage.
Every tool Volt Typhoon uses — Netsh, PowerShell, WMIC — is a legitimate, digitally-signed component of the operating system itself. Traditional antivirus and EDR products are built to identify foreign or unauthorized code; there's no file to flag as malicious when the "malware" is an administrative utility Microsoft ships with Windows. Detection requires behavioral analytics and command-line-level logging, not signature or hash matching.
US government advisories describe the dwell time as multi-year and ongoing at the point of the May 2023 disclosure, meaning the actor had established persistence well before public attribution. Given the LOTL nature of the tradecraft and the difficulty of fully evicting an actor that used only native tools, organizations across the targeted sectors should assume continued targeting and treat eviction/hunt exercises as an ongoing program rather than a one-time response.
Volt Typhoon repurposes compromised small office/home office routers as a proxy relay layer specifically to obscure the true source of malicious traffic reaching the real target — which in many documented cases includes telecom infrastructure. A telecom operator's perimeter defenses that rely on IP reputation or geographic blocking will not flag traffic arriving from a hijacked residential router with a clean history. Any comprehensive security assessment of telecom edge infrastructure needs to account for this relay-layer evasion technique.
NSA, CISA, and FBI attribution states the activity is consistent with preparation for disruptive or destructive cyberattacks against US critical infrastructure — including telecommunications — in the event of a major crisis or conflict, widely understood in the context of a potential Taiwan Strait contingency. This distinguishes Volt Typhoon from espionage-motivated actors: the value of the access isn't the data it can collect today, but the disruption it enables on command.
Conclusion & Next Steps
Volt Typhoon represents a category shift in how nation-state actors approach critical infrastructure: not as a target for espionage, but as terrain to be quietly occupied and held in reserve. Its complete reliance on living-off-the-land techniques demonstrates that the absence of custom malware is not evidence of a less sophisticated actor — it's evidence of one that has adapted precisely to defeat the detection tooling most organizations depend on.
For telecom defenders, the lesson extends well beyond this single campaign: perimeter appliances and SOHO/COTS devices at the network edge require the same patch discipline as core infrastructure, and detection strategy must account for the reality that the most dangerous activity in your network may never involve a single file a scanner would flag. Building that behavioral detection capability — and understanding how LOTL tradecraft fits into the broader telecom threat landscape — is core to the telecom penetration testing methodology TelcoSec's research and Academy tracks are built around.
