Volt Typhoon steps up living‑off‑the‑land activity against U.S. utilities and telecom, targets edge devices for initial access
Marcus Webb ·
Volt Typhoon is again active against U.S. critical infrastructure this week, according to network telemetry shared through sector ISACs and multiple vendors. The PRC‑linked group is focusing on utilities and telecom operators, using compromised small office and home routers for staging and exploiting unpatched network edge appliances, then blending into administrator traffic to persist.
The activity matters because the operators minimize malware use and rely on native tools, which routinely evades endpoint detection. Joint government guidance since 2023 has warned that the objective is long term access for potential disruption and collection, not smash and grab theft.
Updated tradecraft
Investigators report renewed use of WMI and remote PowerShell for discovery and lateral movement, along with cmd.exe, net.exe, schtasks.exe, and wevtutil to enumerate domains and prune logs. On domain controllers the actors attempt to access ntds.dit via ntdsutil and exploit Volume Shadow Copy with vssadmin to aid credential theft, then move to file servers over SMB using valid accounts.
Initial access paths remain concentrated on network and identity edge. PRC operators, including Volt Typhoon and UTA0218, have historically exploited appliance flaws such as PAN‑OS command injection in CVE‑2024‑3400, Ivanti Connect Secure path traversal in CVE‑2023‑46805 and command injection in CVE‑2024‑21887, and Citrix NetScaler ADC remote code execution in CVE‑2023‑3519. Compromised SOHO routers are used as operational relays, which obscures source infrastructure and hinders geo‑based filtering.
Command and control is often proxied over HTTPS with domain fronting or via SSH tunneling from relayed routers. Operators stage tooling in ephemeral locations like C$ and ADMIN$ shares, then revert to scheduled tasks for persistence that mirrors existing maintenance windows to reduce alerting.
Mitigation path
Security teams should patch or isolate vulnerable edge appliances and compare configurations and logs for indicators of tampering, including unexpected admin users and modified authentication settings. Enforce phishing resistant MFA on all remote admin paths, restrict PowerShell remoting to jump hosts, enable Script Block and module logging, and block or alert on use of wmic, net, and schtasks from non‑admin workstations.
On domain controllers enable LSASS protection and Windows Defender Credential Guard, monitor for ntdsutil and unauthorized vssadmin activity, and disable legacy NTLM where possible with SMB signing enforced. Segment OT and IT networks with one way data paths where feasible, require bastion hosts for access, and retain appliance telemetry for months to detect low and slow patterns.
For the broader technology ecosystem, the campaign underscores the security debt in edge appliances and unmanaged routers and the limits of endpoint centric defenses. Vendor moves toward secure by default configurations, verifiable logging on appliances, and lifecycle support commitments will have as much impact as new detection logic inside enterprise networks.