← All threat actors
Volt TyphoonG1017 ↗
[Microsoft] Volt Typhoon, a state-sponsored actor based in China that typically focuses on espionage and information gathering. Microsoft assesses with moderate confidence that this Volt Typhoon campaign is pursuing development of capabilities that could disrupt critical communications infrastructure between the United States and Asia region during future crises. [Secureworks] BRONZE SILHOUETTE likely operates on behalf the PRC. The targeting of U.S.
Motivation
Unknown
Suspected origin
China
Reports / IOCs (VT)
262 reports · 185 IOCs
Reported activity
2023 – 2026
Targeted industries
—Targeted regions
—Associated malware (3)
KVScanLineVersaMem
ATT&CK techniques in reports
- T1059 Command and Scripting Interpreter7
- T1082 System Information Discovery7
- T1555 Credentials from Password Stores7
- T1003 OS Credential Dumping6
- T1016 System Network Configuration Discovery5
- T1033 System Owner/User Discovery5
- T1047 Windows Management Instrumentation5
- T1059.001 PowerShell5
- T1070 Indicator Removal5
- T1027 Obfuscated Files or Information5
- T1005 Data from Local System5
- T1036 Masquerading5
- T1057 Process Discovery5
- T1497 Virtualization/Sandbox Evasion5
- T1573 Encrypted Channel5
- T1059.003 Windows Command Shell4
- T1090 Proxy4
- T1110.003 Password Spraying4
- T1190 Exploit Public-Facing Application4
- T1078 Valid Accounts4
Also known as
Dev-0391, VOLTZITE, Storm-0391, Insidious Taurus, VANGUARD PANDA, BRONZE SILHOUETTE, UNC3236