Atlas Actors147 Names471 Sectors40 Requirements480

⌘K

Atlas Actors147 Names471 Sectors40 Requirements480

LOADING

Volt Typhoon (aka VOLTZITE, Dev-0391) · APT Atlas

Actors/Nation-state / APT/Asia

Volt Typhoon

G1017APTCN · China

AKA VOLTZITE · Dev-0391 · INSIDIOUSTAUR

CrowdStrike: VANGUARD PANDAMandiant: UNC3236MITRE: G1017Secureworks: BRONZE SILHOUETTE

PRC cluster targeting US critical infrastructure with living-off-the-land techniques.

Targets1

Sectors12

Threat types1

GIRs covered0/480

Active since2021

QUICK FACTS

TypeNation-state / APT

OriginChina

First seen2021

Type (verbatim)nation-state APT

GIR coverage0/480

TTPs57

Targets1

Sectors12

Last reviewed2026-07-29

Also tracked as

5 vendor names · 3 other aliases

Open Rosetta Stone

CrowdStrike

VANGUARD PANDA

Mandiant

UNC3236

Microsoft

Volt Typhoon

MITRE

G1017

Secureworks

BRONZE SILHOUETTE

UNATTRIBUTED ALIASESVOLTZITEDev-0391INSIDIOUSTAUR

Victimology

Geographic footprint · 1 countries

origin · Chinatargeted countries · 1

AMERICAS · 1

Sectors targeted

12 of 40

Government100 actors Defense72 actors Aviation22 actors Technology60 actors Telecom72 actors Energy / Utilities59 actors Oil and Gas21 actors Education & Research62 actors Manufacturing (man)50 actors Transportation31 actors Logistics22 actors Maritime24 actors

Tactics, techniques, procedures

Threat types + MITRE ATT&CK mapping

THREAT TYPES

ESP · Espionage

MITRE ATT&CK · 57 techniques

Reconnaissance · 8

T1589.002Email Addresses T1590Gather Victim Network Information T1591Gather Victim Org Information T1591.004Identify Roles T1592Gather Victim Host Information T1593Search Open Websites/Domains T1594Search Victim-Owned Websites T1596.005Scan Databases

Initial Access · 1

T1190Exploit Public-Facing Application

Execution · 4

T1047Windows Management Instrumentation

Privilege Escalation · 1

T1068Exploitation for Privilege Escalation

Credential Access · 6

T1003.001LSASS Memory

Discovery · 18

T1007System Service Discovery T1010Application Window Discovery T1012Query Registry

Lateral Movement · 2

T1021.001Remote Desktop Protocol T1570Lateral Tool Transfer

Collection · 4

T1005Data from Local System T1074Data Staged T1113Screen Capture

Command And Control · 4

T1090Proxy T1090.001Internal Proxy

Defense Impairment · 1

T1112Modify Registry

Stealth · 8

T1027.002Software Packing T1036.005Match Legitimate Resource Name or Location

GIR coverage

0 / 480 requirements satisfied

No GIRs mapped yet for this actor.

Open data

Machine-readable exports of this profile

JSON · RESTActor recordFull profile via the public v1 API STIX 2.1Intrusion-set bundleDeterministic ids · techniques + targeted countries ATT&CK NAVIGATORTechnique layer57 techniques · layer format 4.5

Related actors

By origin and actor type

APT31nation-state

China · 6 targets · since 2013

APT8nation-state

China · 5 targets · since —

APT24nation-state

China · 3 targets · since 2008

APT27nation-state

China · 23 targets · since 2010

APT44nation-state

Russia · 25 targets · since 2009

APT21nation-state

China · 5 targets · since 2010

T1059.001

PowerShell

T1059.003Windows Command Shell

T1059.004Unix Shell

T1003.003

NTDS

T1552Unsecured Credentials

T1552.004Private Keys

T1555Credentials from Password Stores

T1555.003Credentials from Web Browsers

T1016System Network Configuration Discovery

T1018Remote System Discovery

T1033System Owner/User Discovery

T1046Network Service Discovery

T1049System Network Connections Discovery

T1057Process Discovery

T1069.001Local Groups

T1083File and Directory Discovery

T1120Peripheral Device Discovery

T1124System Time Discovery

T1217Browser Information Discovery

T1518Software Discovery

T1614System Location Discovery

T1654Log Enumeration

T1680Local Storage Discovery

T1560.001

Archive via Utility

T1090.003

Multi-hop Proxy

T1105Ingress Tool Transfer

T1036.008

Masquerade File Type

T1070.004File Deletion

T1078Valid Accounts

T1078.002Domain Accounts

T1140Deobfuscate/Decode Files or Information

T1218System Binary Proxy Execution