Volt Typhoon
China-state actor pre-positioning in US critical infrastructure; operates KV Botnet for covert relay.
CISA assessed in February 2026 that Volt Typhoon holds footholds in US power, water, transport and communications networks, positioned to move into the industrial systems that run them; the FBI said the same month that Salt Typhoon, a separate China-linked campaign, was still live.
Last refreshed: 12 October 2026 · Appears in 1 active topic
Is Volt Typhoon already inside US and allied power grids, waiting for an order to act?
Timeline for Volt Typhoon
Mentioned in: Ten agencies name Beijing firm in hacks
Cybersecurity: Threats and DefencesMentioned in: 86,644 Fortinet logins become a hit list
Cybersecurity: Threats and DefencesNorway joins the Salt Typhoon victim list
Cybersecurity: Threats and DefencesSixteen cyber agencies name Flax Typhoon network
Cybersecurity: Threats and DefencesMentioned in: FBI: Salt Typhoon still very much live
Cybersecurity: Threats and DefencesBackground
Volt Typhoon is a China state-sponsored cyber actor first publicly disclosed by Microsoft and CISA in May 2023, with activity traced to at least mid-2021. It relies on living-off-the-land techniques, using built-in Windows tools such as Netsh, Ntdsutil and PowerShell instead of custom malware, which makes its activity hard to tell apart from routine administration.
It routes traffic through the KV Botnet, a network of compromised end-of-life Cisco and Netgear routers that no longer receive security patches; the FBI disrupted an earlier version of the botnet in 2024. Its targets span communications, utilities, transport, maritime, government and manufacturing, with a focus on the United States, Guam and the Indo-Pacific. Microsoft assessed in 2023 that the group was positioning to disrupt communications between the US and the Asia-Pacific region in a future crisis.
That mission sets Volt Typhoon apart from most state actors. Its value lies in access held in reserve, so Western agencies treat it as sabotage readiness rather than intelligence gathering. It has become the reference case when analysts judge whether other intrusions, such as the June 2026 haul of 86,644 Fortinet firewall logins, look like preparation rather than crime.
Volt Typhoon pre-positions for sabotage
In February 2026 an FBI official confirmed that Salt Typhoon's telecoms intrusion was still running across at least 200 companies in 80 countries. CISA, in parallel, kept its high-confidence assessment that Volt Typhoon is pre-positioning in US infrastructure IT networks for later movement into operational technology. The distinction defines Volt Typhoon: Salt Typhoon reads traffic, while Volt Typhoon prepares to switch things off.
On 23 April sixteen national cyber agencies co-signed an advisory conceding that indicator blocklists go stale as fast as analysts publish them, the problem that Volt Typhoon's churn through compromised edge devices had already exposed. The advisory itself named Flax Typhoon and Integrity Technology Group. For anyone defending against Volt Typhoon, its point was that blocking known addresses alone no longer works.
What is Volt Typhoon and what does it want inside US infrastructure?
What are living-off-the-land techniques and why does Volt Typhoon use them?
What is the KV Botnet used by Volt Typhoon?
Has Volt Typhoon been removed from US critical infrastructure?
