Be respectful in your interactions with fellow members. You can Go Here to read our Terms and Rules. Visit My Profile to create your avatar and see your posts. If you to report a bug or issue, email us at support.GI US.com

Title: October 16, 2025

GZB MORNING BRIEF 16 OCTOBER 2025

VOLT TYPHOON

Volt Typhoon is a state-sponsored cyber threat actor affiliated with the People's Republic of China (PRC) that poses a significant and ongoing threat to U.S. and allied critical infrastructure. The group is known for establishing long-term, covert access to networks to enable potential disruptive or destructive attacks in the event of a geopolitical crisis, such as a conflict involving Taiwan.

Key characteristics and activities

• Persistent pre-positioning: Volt Typhoon's primary objective is not immediate destruction but persistent access. The group maintains a presence within critical infrastructure networks for extended periods, sometimes for years, to prepare for potential future attacks.

• Targeted sectors: The group specifically targets critical infrastructure, including communications, energy, transportation systems, and water and wastewater systems. Organizations in U.S. territories, particularly Guam, have been a focus of these intrusions due to their strategic military importance.

• "Living off the Land" (LotL) tactics: To remain undetected, Volt Typhoon uses native, legitimate tools already present in a victim's network, such as PowerShell and Windows Management Instrumentation (WMI). This technique allows them to blend in with normal network activity and bypass traditional security defenses.

• Use of botnets: Volt Typhoon has heavily relied on botnets composed of compromised small office and home office (SOHO) routers to conceal their activity. These devices act as relay nodes, making malicious traffic appear to come from legitimate, U.S.-based systems. Despite efforts by the FBI to disrupt these botnets, the group has proven resilient and quickly re-established infrastructure.

• Exploitation of known vulnerabilities: The group often gains initial access by exploiting publicly known vulnerabilities in common network appliances, such as those made by Fortinet, Ivanti, and Cisco. They have successfully leveraged insecure firmware and unpatched systems to breach networks.

Threat assessment and latest developments

• Strategic threat: Federal officials, including FBI Director Christopher Wray, have called Volt Typhoon one of the most serious cyber threats to national security. A successful, large-scale attack could distract and tie up U.S. resources during an international crisis, particularly one involving Taiwan.

• Recent activities:

◦ In January 2024, the FBI took action to dismantle Volt Typhoon's KV botnet, but the group demonstrated its resilience by rebuilding its infrastructure shortly after.

◦ Intelligence agencies from the "Five Eyes" alliance (U.S., UK, Canada, Australia, and New Zealand) have released joint advisories about Volt Typhoon's activities throughout 2024.

◦ In October 2025, officials from CISA and other agencies continued to highlight the threat posed by Volt Typhoon targeting U.S. critical infrastructure.

• Resilience and adaptation: Volt Typhoon has repeatedly demonstrated its ability to recover from setbacks and evolve its tactics. This includes targeting supply chain vulnerabilities and adapting to new environments.

Mitigation strategies

To defend against Volt Typhoon, cybersecurity agencies like CISA recommend focusing on fundamental security measures:

• Prompt patching: Address known vulnerabilities, especially on public-facing devices, by applying security patches in a timely manner.

• Multi-factor authentication (MFA):Enforce MFA to protect against credential theft, a primary objective of the group.

• Improved logging and monitoring:Enhance log retention periods and monitor network activity, including routine administrative tasks, to detect malicious behavior that mimics normal operations.

• Robust "End of Life" management:Replace outdated and unsupported network devices that are more susceptible to exploitation.

• Network segmentation: Segment IT and OT (operational technology) networks to limit lateral movement and protect critical operational systems.

VANGUARD PANDA

U.S. government agencies and Microsoft detected activity on critical infrastructure in the United States and Guam by a new Chinese threat actor dubbed Volt Typhoon. The attacks were primarily designed to gather information on U.S. critical infrastructure and military capabilities, but Microsoft and the agencies said the attacks could be preparation for a future attack on U.S. critical infrastructure. Also known as Vanguard Panda.

Pray.

Train.

Stay informed.

Build resilient communities.

—END REPORT