Volt Typhoon

Volt Typhoon

News: FBI shuts down China’s ‘Volt Typhoon’ hackers targeting U.S. infrastructure

About:
• Volt Typhoon, also known as BRONZE SILHOUETTE or Group G1017, is a state-sponsored Advanced Persistent Threat (APT) group believed to originate from the People’s Republic of China. This group has been active since at least 2021.
• The group is known for its sophisticated cyber activities, which are closely monitored and documented by various cybersecurity firms, intelligence agencies, and government bodies worldwide.
• Volt Typhoon typically focuses on espionage and information gathering. It has targeted critical infrastructure organizations in the US, including Guam.

What is living off the land technique?
• One of the significant campaigns of Volt Typhoon involved targeting US critical infrastructure with livingoff-the-land techniques. The group puts a strong emphasis on stealth in this campaign, relying almost exclusively on living-off-the-land techniques and hands-on-keyboard activity. They issue commands via the command line to collect data, including credentials from local and network systems, put the data into an archive file to stage it for exfiltration, and then use the stolen valid credentials to maintain persistence.