Procedure examples

Volt Typhoon has used webshells, including ones named AuditReport.jspx and iisstart.aspx, in compromised environments.

Volt Typhoon has queried the Registry on compromised systems for information on installed software.

Volt Typhoon has obtained credentials insecurely stored on targeted network appliances.

Volt Typhoon has accessed a Local State file that contains the AES key used to encrypt passwords stored in the Chrome browser.

Volt Typhoon has attempted to obtain credentials from OpenSSH, realvnc, and PuTTY.

Volt Typhoon has targeted network administrator browser data including browsing history and stored credentials.

Volt Typhoon has archived the ntds.dit database as a multi-volume password-protected archive with 7-Zip.

Volt Typhoon has copied web shells between servers in targeted environments.

Volt Typhoon has used a version of the Awen web shell that employed AES encryption and decryption for C2 communications.

Volt Typhoon has compromised Virtual Private Servers (VPS) to proxy C2 traffic.

Volt Typhoon has used compromised Paessler Router Traffic Grapher (PRTG) servers from other organizations for C2.

Volt Typhoon has used compromised Cisco and NETGEAR end-of-life SOHO routers implanted with KV Botnet malware to support operations.

Volt Typhoon has compromised small office and home office (SOHO) network edge devices, many of which were located in the same geographic area as the victim, to proxy network traffic.

Volt Typhoon has exploited zero-day vulnerabilities for initial access.

Volt Typhoon has used legitimate network and forensic tools and customized versions of open-source tools for C2.

Volt Typhoon has used publicly available exploit code for initial access.

Volt Typhoon has gathered victim identify information during pre-compromise reconnaissance.

Volt Typhoon has targeted the personal emails of key network and IT staff at victim organizations.

Volt Typhoon has conducted extensive pre-compromise reconnaissance to learn about the target organization’s network.

Volt Typhoon has conducted extensive reconnaissance of victim networks including identifying network topologies.

Volt Typhoon has identified target network security measures as part of pre-compromise reconnaissance.

Volt Typhoon has conducted extensive reconnaissance pre-compromise to gain information about the targeted organization.

Volt Typhoon has identified key network and IT staff members pre-compromise at targeted organizations.

Volt Typhoon has conducted pre-compromise reconnaissance for victim host information.

Volt Typhoon has conducted pre-compromise web searches for victim information.

Volt Typhoon has conducted pre-compromise reconnaissance on victim-owned sites.

Volt Typhoon has used FOFA, Shodan, and Censys to search for exposed victim infrastructure.

Volt Typhoon has obtained the victim's system current location.

Volt Typhoon has used `wevtutil.exe` and the PowerShell command `Get-EventLog security` to enumerate Windows logs to search for successful logons.

Volt Typhoon has discovered file system types, drive names, size, and free space on compromised systems.

Volt Typhoon has selectively cleared Windows Event Logs, system logs, and other technical artifacts to remove evidence of intrusion activity.