Volt Typhoon
BRONZE SILHOUETTEVANGUARD PANDAUNC3236Insidious TaurusVOLTZITEDev-0391Storm-0391DazedToad
[Microsoft] Volt Typhoon, a state-sponsored actor based in China that typically focuses on espionage and information gathering. Microsoft assesses with moderate confidence that this Volt Typhoon campaign is pursuing development of capabilities that could disrupt critical communications infrastructure between the United States and Asia region during future crises. [Secureworks] BRONZE SILHOUETTE… Source: MISP
Attributed country: CN according to MISP
Activity on Jábega · 12 weeks
1 stories · first seen on 28 Oct 2026 · last seen on 28 Oct 2026
News
- Volt Typhoon hides zero-day attacks using 'Silent Train' frameworkBleepingComputer · 28 Oct 2026
MITRE ATT&CK techniques
Reconnaissance
T1589Gather Victim Identity Information 3 Sigma rulesT1589.002Email Addresses 1 Sigma rulesT1590Gather Victim Network Information 4 Sigma rulesT1590.004Network TopologyT1590.006Network Security AppliancesT1591Gather Victim Org Information 2 Sigma rulesT1591.004Identify Roles 2 Sigma rulesT1592Gather Victim Host Information 3 Sigma rulesT1593Search Open Websites/Domains 2 Sigma rulesT1594Search Victim-Owned WebsitesT1596.005Scan Databases
Resource Development
T1584.003Virtual Private ServerT1584.004ServerT1584.005BotnetT1584.008Network DevicesT1587.004ExploitsT1588.002Tool 7 Sigma rulesT1588.006Vulnerabilities
Initial Access
T1078Valid Accounts 82 Sigma rulesT1078.002Domain Accounts 3 Sigma rulesT1133External Remote Services 17 Sigma rulesT1190Exploit Public-Facing Application 40 Sigma rules
Execution
T1047Windows Management Instrumentation 40 Sigma rulesT1059.001PowerShell 40 Sigma rulesT1059.003Windows Command Shell 40 Sigma rulesT1059.004Unix Shell 17 Sigma rules
Persistence
Privilege Escalation
Credential Access
T1003.001LSASS Memory 40 Sigma rulesT1003.003NTDS 23 Sigma rulesT1056.001Keylogging 3 Sigma rulesT1552Unsecured Credentials 47 Sigma rulesT1552.004Private Keys 6 Sigma rulesT1555Credentials from Password Stores 18 Sigma rulesT1555.003Credentials from Web Browsers 6 Sigma rules
Discovery
T1007System Service Discovery 7 Sigma rulesT1010Application Window Discovery 1 Sigma rulesT1012Query Registry 11 Sigma rulesT1016System Network Configuration Discovery 4 Sigma rulesT1016.001Internet Connection DiscoveryT1018Remote System Discovery 9 Sigma rulesT1033System Owner/User Discovery 26 Sigma rulesT1046Network Service Discovery 17 Sigma rulesT1049System Network Connections Discovery 2 Sigma rulesT1057Process Discovery 3 Sigma rulesT1069Permission Groups Discovery 14 Sigma rulesT1069.001Local Groups 6 Sigma rulesT1069.002Domain Groups 13 Sigma rulesT1083File and Directory Discovery 17 Sigma rulesT1087.001Local Account 8 Sigma rulesT1087.002Domain Account 19 Sigma rulesT1120Peripheral Device DiscoveryT1124System Time Discovery 1 Sigma rulesT1217Browser Information DiscoveryT1497.001System Checks 3 Sigma rulesT1518Software Discovery 9 Sigma rulesT1614System Location Discovery 2 Sigma rulesT1654Log EnumerationT1680Local Storage Discovery
Lateral Movement
Collection
T1005Data from Local System 12 Sigma rulesT1074Data Staged 5 Sigma rulesT1074.001Local Data Staging 4 Sigma rulesT1113Screen Capture 6 Sigma rulesT1560.001Archive via Utility 10 Sigma rules
Command and Control
T1090Proxy 31 Sigma rulesT1090.001Internal Proxy 6 Sigma rulesT1090.003Multi-hop Proxy 3 Sigma rulesT1105Ingress Tool Transfer 40 Sigma rulesT1573.001Symmetric Cryptography
Stealth
T1006Direct Volume AccessT1027.002Software PackingT1036.005Match Legitimate Resource Name or Location 20 Sigma rulesT1036.008Masquerade File TypeT1070.004File Deletion 9 Sigma rulesT1070.007Clear Network Connection History and ConfigurationsT1140Deobfuscate/Decode Files or Information 17 Sigma rulesT1218System Binary Proxy Execution 137 Sigma rules
Defense impairment
Relationships come from co-occurrence in the news, not attribution. Sources: MISP galaxy, MITRE ATT&CK and SigmaHQ. attack.mitre.org ↗