File · Volt Typhoon · Unknown · assessed origin China · misp-galaxy + mitre-attack · refreshed 2026-10-06
Volt Typhoon
- BRONZE SILHOUETTE
- VANGUARD PANDA
- UNC3236
- Insidious Taurus
- VOLTZITE
- Dev-0391
- Storm-0391
- Vanguard Panda
attack rose · 81 techniques across 13 tactics
What changed
ledger · newest first- —todaynew CVE4 new CVEs: CVE-2021-40539, CVE-2022-42475, CVE-2023-27997, CVE-2024-39717
Analyst brief
misp-galaxy + mitre-attack[Microsoft] Volt Typhoon, a state-sponsored actor based in China that typically focuses on espionage and information gathering. Microsoft assesses with moderate confidence that this Volt Typhoon campaign is pursuing development of capabilities that could disrupt critical communications infrastructure between the United States and Asia region during future crises.
[Secureworks] BRONZE SILHOUETTE likely operates on behalf the PRC. The targeting of U.S. government and defense organizations for intelligence gain aligns with PRC requirements, and the tradecraft observed in these engagements overlap with other state-sponsored Chinese threat groups.
Kill chain
MITRE ATT&CK Enterprise · tap a technique81 techniques · 13 of 15 tactics
Reconnaissance
11 techniquesResource development
7 techniquesInitial access
1 techniqueExecution
4 techniquesPersistence
2 techniquesPrivilege escalation
1 techniqueStealth
11 techniquesDefense impairment
2 techniquesCredential access
6 techniquesDiscovery
23 techniquesLateral movement
2 techniquesCollection
6 techniquesCommand and control
5 techniques
select a technique
Arsenal
1 malware · 16 tools| Malware · 1 | ATT&CK |
|---|---|
| VersaMem | S1154 ↗ |
as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id
CVEs cited sources tie to Volt Typhoon
none on KEV- CVE-2022-424752026-10-17
“In one confirmed compromise, Volt Typhoon actors likely obtained initial access by exploiting CVE-2022-42475 in a network perimeter FortiGate 300D firewall that was not patched.”
cited as exploiting · source: cisa.gov ↗ · 2026-10-17
- CVE-2021-405392026-10-17
“In late 2021, Unit 42 observed a threat actor (now identified as Insidious Taurus) using a then-undisclosed Zoho ManageEngine ADSelfService Plus vulnerability ( CVE-2021-40539 ) for initial access.”
cited as exploiting · source: unit42.paloaltonetworks.com ↗ · 2026-10-17
- CVE-2024-397172026-10-17
“Versa Director Zero Day Exploitation involved exploitation of a vulnerability in Versa Director servers, since identified as CVE-2024-39717, for initial access and code execution.”
cited as used in a campaign · named nearby · source: attack.mitre.org ↗ · 2026-10-17
- CVE-2023-279972026-10-17
“Volt Typhoon, which is a state-sponsored actor based in China documented by Microsoft , was reportedly carrying out the exploit against FortiOS/FortiProxy (CVE-2023-27997)”
attributed by a report · source: trendmicro.com ↗ · 2026-10-17
Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.
Take it with you
keyless · no signupReferences
10 sources- 1.secureworks.com/blog/chinese-cyberespionage-group-bronze-silhouette-ta…
- 2.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us…
- 3.unit42.paloaltonetworks.com/volt-typhoon-threat-brief
- 4.dragos.com/threat/voltzite
- 5.attack.mitre.org/groups/G1017
- 6.blog.cloudflare.com/2026-threat-report
- 7.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sp…
- 8.web.archive.org/web/20230601025540/https://www.secureworks.com/blog/ch…
- 9.5943619.hs-sites.com/hubfs/312-Year-in-Review/2026/Dragos-2026-OT-Cybersecu…
- 10.media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land…
Track Volt Typhoon on the wire.
This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.
Check your stack
Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.
Stack checkNo key. No signup.