In February, the FBI issued an advisory against Volt typhoon’s threat activities, listing out the tactics, techniques, and procedures (TTPs) used by the group. “The US authoring agencies have confirmed that Volt Typhoon has compromised the IT environments of multiple critical infrastructure organizations — primarily in Communications, Energy, Transportation Systems, and Water and Wastewater Systems Sectors — in the continental and non-continental United States and its territories, including Guam,” the advisory said.
In a December 2023 operation, the FBI disrupted a fraction of the Volt Typhoon operations by pulling down a botnet of hundreds of US based small-office or home-office (SOHO) routers.
To obtain initial access, Volt Typhoon actors commonly exploit vulnerabilities in networking appliances such as those from Fortinet, Ivanti Connect Secure (formerly Pulse Secure), NETGEAR, Citrix, and Cisco. Salt Typhoon, along with another China-linked APT Flax Typhoon, likely employs similar techniques for early infections.
