Actors/Nation-state / APT/Asia

Volt Typhoon

G1017APTCN · China

AKA VOLTZITE · Dev-0391 · INSIDIOUSTAUR

CrowdStrike: VANGUARD PANDAMandiant: UNC3236MITRE: G1017Secureworks: BRONZE SILHOUETTE

PRC cluster targeting US critical infrastructure with living-off-the-land techniques.

Targets1

Sectors12

Threat types1

GIRs mapped0/480

Active since2021

Explore in atlas

Also tracked as

5 vendor names · 3 other aliases

Open Rosetta Stone

CrowdStrike

VANGUARD PANDA

Mandiant

UNC3236

Microsoft

Volt Typhoon

MITRE

G1017

Secureworks

BRONZE SILHOUETTE

UNATTRIBUTED ALIASESVOLTZITEDev-0391INSIDIOUSTAUR

Victimology

Geographic footprint · 1 countries

Export STIX

origin · Chinatargeted countries · 1

AMERICAS · 1

United States

Sectors targeted

12 of 40

Government100 actors Defense72 actors Aviation22 actors Technology60 actors Telecom71 actors Energy / Utilities58 actors Oil and Gas21 actors Education & Research62 actors Manufacturing (man)49 actors Transportation31 actors Logistics21 actors Maritime24 actors

Tactics, techniques, procedures

Threat types + MITRE ATT&CK mapping

THREAT TYPES

ESP · Espionage

MITRE ATT&CK · 57 techniques

Reconnaissance · 8

T1589.002Email Addresses T1590Gather Victim Network Information T1591Gather Victim Org Information T1591.004Identify Roles T1592Gather Victim Host Information T1593Search Open Websites/Domains T1594Search Victim-Owned Websites T1596.005Scan Databases

Initial Access · 1

T1190Exploit Public-Facing Application

Execution · 4

T1047Windows Management Instrumentation

Privilege Escalation · 1

T1068Exploitation for Privilege Escalation

Credential Access · 6

T1003.001LSASS Memory

Discovery · 18

T1007System Service Discovery T1010Application Window Discovery T1012Query Registry

Lateral Movement · 2

T1021.001Remote Desktop Protocol T1570Lateral Tool Transfer

Collection · 4

T1005Data from Local System T1074Data Staged T1113Screen Capture

Command And Control · 4

T1090Proxy T1090.001Internal Proxy

Defense Impairment · 1

T1112Modify Registry

Stealth · 8

T1027.002Software Packing T1036.005Match Legitimate Resource Name or Location

GIR mappings

0 / 480 requirements mapped

Open matrix

No GIRs mapped yet for this actor.

References

No supporting references have been recorded for this profile. Treat uncited claims as unverified.

Open data

Machine-readable exports of this profile

JSON · RESTActor recordFull profile via the public v1 API STIX 2.1Intrusion-set bundleDeterministic ids · techniques + targeted countries ATT&CK NAVIGATORTechnique layer57 techniques · layer format 4.5

Related actors

By origin and actor type

T1059.001

PowerShell

T1059.003Windows Command Shell

T1059.004Unix Shell

T1003.003

NTDS

T1552Unsecured Credentials

T1552.004Private Keys

T1555Credentials from Password Stores

T1555.003Credentials from Web Browsers

T1016System Network Configuration Discovery

T1018Remote System Discovery

T1033System Owner/User Discovery

T1046Network Service Discovery

T1049System Network Connections Discovery

T1057Process Discovery

T1069.001Local Groups

T1083File and Directory Discovery

T1120Peripheral Device Discovery

T1124System Time Discovery

T1217Browser Information Discovery

T1518Software Discovery

T1614System Location Discovery

T1654Log Enumeration

T1680Local Storage Discovery

T1560.001

Archive via Utility

T1090.003

Multi-hop Proxy

T1105Ingress Tool Transfer

T1036.008

Masquerade File Type

T1070.004File Deletion

T1078Valid Accounts

T1078.002Domain Accounts

T1140Deobfuscate/Decode Files or Information

T1218System Binary Proxy Execution