Volt Typhoon
BRONZE SILHOUETTEVANGUARD PANDAUNC3236Insidious TaurusVOLTZITEDev-0391Storm-0391DazedToad
[Microsoft] Volt Typhoon, a state-sponsored actor based in China that typically focuses on espionage and information gathering. Microsoft assesses with moderate confidence that this Volt Typhoon campaign is pursuing development of capabilities that could disrupt critical communications infrastructure between the United States and Asia region during future crises. [Secureworks] BRONZE SILHOUETTE… Fuente: MISP
País atribuido: CN según MISP
Actividad en Jábega · 12 semanas
1 noticias · vista por primera vez el 28 oct 2026 · la última, el 28 oct 2026
Noticias
- Volt Typhoon hides zero-day attacks using 'Silent Train' frameworkBleepingComputer · 28 oct 2026
Técnicas MITRE ATT&CK
Reconocimiento
T1589Gather Victim Identity Information 3 reglas SigmaT1589.002Email Addresses 1 reglas SigmaT1590Gather Victim Network Information 4 reglas SigmaT1590.004Network TopologyT1590.006Network Security AppliancesT1591Gather Victim Org Information 2 reglas SigmaT1591.004Identify Roles 2 reglas SigmaT1592Gather Victim Host Information 3 reglas SigmaT1593Search Open Websites/Domains 2 reglas SigmaT1594Search Victim-Owned WebsitesT1596.005Scan Databases
Preparación de recursos
T1584.003Virtual Private ServerT1584.004ServerT1584.005BotnetT1584.008Network DevicesT1587.004ExploitsT1588.002Tool 7 reglas SigmaT1588.006Vulnerabilities
Acceso inicial
T1078Valid Accounts 82 reglas SigmaT1078.002Domain Accounts 3 reglas SigmaT1133External Remote Services 17 reglas SigmaT1190Exploit Public-Facing Application 40 reglas Sigma
Ejecución
T1047Windows Management Instrumentation 40 reglas SigmaT1059.001PowerShell 40 reglas SigmaT1059.003Windows Command Shell 40 reglas SigmaT1059.004Unix Shell 17 reglas Sigma
Persistencia
Escalada de privilegios
Acceso a credenciales
T1003.001LSASS Memory 40 reglas SigmaT1003.003NTDS 23 reglas SigmaT1056.001Keylogging 3 reglas SigmaT1552Unsecured Credentials 47 reglas SigmaT1552.004Private Keys 6 reglas SigmaT1555Credentials from Password Stores 18 reglas SigmaT1555.003Credentials from Web Browsers 6 reglas Sigma
Descubrimiento
T1007System Service Discovery 7 reglas SigmaT1010Application Window Discovery 1 reglas SigmaT1012Query Registry 11 reglas SigmaT1016System Network Configuration Discovery 4 reglas SigmaT1016.001Internet Connection DiscoveryT1018Remote System Discovery 9 reglas SigmaT1033System Owner/User Discovery 26 reglas SigmaT1046Network Service Discovery 17 reglas SigmaT1049System Network Connections Discovery 2 reglas SigmaT1057Process Discovery 3 reglas SigmaT1069Permission Groups Discovery 14 reglas SigmaT1069.001Local Groups 6 reglas SigmaT1069.002Domain Groups 13 reglas SigmaT1083File and Directory Discovery 17 reglas SigmaT1087.001Local Account 8 reglas SigmaT1087.002Domain Account 19 reglas SigmaT1120Peripheral Device DiscoveryT1124System Time Discovery 1 reglas SigmaT1217Browser Information DiscoveryT1497.001System Checks 3 reglas SigmaT1518Software Discovery 9 reglas SigmaT1614System Location Discovery 2 reglas SigmaT1654Log EnumerationT1680Local Storage Discovery
Movimiento lateral
Recopilación
T1005Data from Local System 12 reglas SigmaT1074Data Staged 5 reglas SigmaT1074.001Local Data Staging 4 reglas SigmaT1113Screen Capture 6 reglas SigmaT1560.001Archive via Utility 10 reglas Sigma
Mando y control
T1090Proxy 31 reglas SigmaT1090.001Internal Proxy 6 reglas SigmaT1090.003Multi-hop Proxy 3 reglas SigmaT1105Ingress Tool Transfer 40 reglas SigmaT1573.001Symmetric Cryptography
Stealth
T1006Direct Volume AccessT1027.002Software PackingT1036.005Match Legitimate Resource Name or Location 20 reglas SigmaT1036.008Masquerade File TypeT1070.004File Deletion 9 reglas SigmaT1070.007Clear Network Connection History and ConfigurationsT1140Deobfuscate/Decode Files or Information 17 reglas SigmaT1218System Binary Proxy Execution 137 reglas Sigma
Defense impairment
Relaciones por coaparición en noticias, no atribución. Fuentes: MISP galaxy, MITRE ATT&CK y SigmaHQ. attack.mitre.org ↗