What's in a Name? Volt Typhoon Is Already Inside U.S. Infrastructure, and Nobody Agrees What to Call It

Source: Microsoft Threat Intelligence

by Tanya Reddy Sattineni

In February 2024, several U.S. intelligence agencies including CISA, the NSA, and the FBI, confirmed that a Chinese state-sponsored group called Volt Typhoon had compromised the IT environments of America’s critical infrastructure organizations. These organizations were primarily in communications, energy, transportation, and water and wastewater. The agencies said the group's targeting and behavior did not fit traditional espionage. It was not there to steal secrets. It was there to wait.

Microsoft first publicly attributed the group in May 2023. U.S. agencies now believe with high confidence that Volt Typhoon’s operators are using digital networks to disrupt physical equipment.

Geography is a prime motivator for most of the group’s targets. Microsoft assessed that Guam, a major U.S. military and logistics hub in the Pacific, could be leveraged by Volt Typhoon to  support Chinese military objectives in a future crisis. In a conflict over Taiwan, Volt Typhoon would be able to knock out communications, power, or water to slow American mobilization and unsettle the public at home. The intrusions look less like theft and more like capability held in reserve.

In one case, Volt Typhoon copied diagrams and system documentation in a water-sector compromise. The actors moved through the network over nine months and potentially reached profiles for water treatment plants, wells, and an electrical substation. In other words, reconnaissance for physical effects.

What makes Volt Typhoon so hard to catch is a technique known as "living off the land," or LOTL. Instead of deploying custom malware, the group uses legitimate administrative tools already present on a system, such as built-in Windows utilities, together with stolen credentials. To security software, a real login running a built-in tool looks like an administrator doing routine work. There is no malicious file to flag.

The group also disguises where it comes from. It has been linked to compromised small-office and home-office routers that mask its traffic so that intrusions appear to originate from ordinary American devices. Once inside a network, it conducts extensive reconnaissance and then goes nearly silent, which suggests the objective is persistence rather than immediate damage. A quiet intruder produces few alerts.

Different security firms see different slices of the same activity, and none wants to claim more certainty than it has, given the risk of false attribution. So each has built its own naming scheme. CrowdStrike uses animals to signal origin: Bears for Russia, pandas for China, kittens for Iran, Chollimas (a mythical winged horse) for North Korea. Volt Typhoon is its Vanguard Panda. Mandiant, a Google subsidiary, uses neutral numbers instead: APT28, the group CrowdStrike calls Fancy Bear, is simply the twenty-eighth advanced persistent threat the firm formally catalogued. Microsoft, which once named groups after chemical elements, switched in 2023 to weather: Typhoon for China, Blizzard for Russia, Sandstorm for Iran, Sleet for North Korea. The first word, like Volt, Salt, Flax or Silk, only keeps sibling groups apart.

This diversity in naming structures results in a translation problem in which nobody agrees upon a shared vernacular. This disagreement isn't simply cosmetic. If three incident response teams are employing three different names for one actor, they're also making three separate judgment calls about severity, timeline, and response, with no way to know whether they're actually addressing the same adversary. Even a shared name may not fully solve this, because there is often no signature around which to standardize in the first place.

Detection has to instead rest on behavioral baselining, which is the process of building a dynamic profile of normal, expected activity for users, devices, applications, or networks so that unusual deviations can be flagged as potential threat. Noticing that a valid account is suddenly running discovery commands at 3 a.m., for example, is much harder for an industry to agree on than a name.

Volt Typhoon’s main tool is stolen logins, so the best defenses make those logins less useful. Security keys and passkeys, which can't be fooled by a fake login page, mean a stolen password alone isn't enough. Limiting each employee's access to what their job requires keeps one stolen account from traveling far, and regularly pruning administrator-level access shrinks the pool of accounts worth stealing.

Organizations can also limit the damage if someone gets in. Walling off the office network from the systems that run pumps, valves, and power controls makes it much harder to go from reading diagrams to touching controls. And because the agencies warn these intrusions may already exist, defenders are urged to assume they've been breached and actively hunt for signs of it rather than wait for an alarm.

Volt Typhoon proves that in modern international conflict, the opening move can be made without the opponent even noticing. It doesn’t help when the cyber industry assigns three names (and counting) to the player on the other side of the board. Its victims, in most cases, never saw it under any of them.