Volt Typhoon
IntrusionSet · ATTACK:enterprise:G1017
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:G1017",
"title": "Volt Typhoon",
"type": "IntrusionSet",
"source_url": "https://attack.mitre.org/groups/G1017",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "intrusion-set--174279b4-399f-4ddb-966e-5efedd1dd5f2",
"external_id": "G1017",
"domain": "enterprise",
"created": "2023-07-27T20:35:46.206Z",
"modified": "2026-07-31T18:47:38.941Z",
"version": "2.0",
"aliases": [
"Volt Typhoon",
"BRONZE SILHOUETTE",
"Vanguard Panda",
"DEV-0391",
"UNC3236",
"Voltzite",
"Insidious Taurus",
"DazedToad"
],
"tactics": [
],
"source_references": [
{
"source_name": "Cloudflare 2026 Threat Report New Threat Actors March 2026",
"url": "https://blog.cloudflare.com/2026-threat-report/"
},
{
"source_name": "Vanguard Panda"
},
{
"source_name": "DEV-0391"
},
{
"source_name": "UNC3236"
},
{
"source_name": "Voltzite"
},
{
"source_name": "Insidious Taurus"
},
{
"source_name": "DazedToad"
},
{
"source_name": "BRONZE SILHOUETTE"
},
{
"source_name": "CISA AA24-038A PRC Critical Infrastructure February 2024",
"url": "https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"
},
{
"source_name": "Secureworks BRONZE SILHOUETTE May 2023",
"url": "https://web.archive.org/web/20230601025540/https://www.secureworks.com/blog/chinese-cyberespionage-group-bronze-silhouette-targets-us-government-and-defense-organizations"
},
{
"source_name": "Dragos 2025 Year in Review",
"url": "https://5943619.hs-sites.com/hubfs/312-Year-in-Review/2026/Dragos-2026-OT-Cybersecurity-Report-A-Year-in-Review.pdf?hsCtaAttrib=205683189348"
},
{
"source_name": "Microsoft Volt Typhoon May 2023",
"url": "https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/"
},
{
"source_name": "Joint Cybersecurity Advisory Volt Typhoon June 2023",
"url": "https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF"
},
{
"source_name": "DOJ KVBotnet 2024",
"url": "https://www.justice.gov/opa/pr/us-government-disrupts-botnet-peoples-republic-china-used-conceal-hacking-critical"
}
]
}Explicit source assertions (100)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1046
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--02279a7e-d5b8-44a7-99a3-64913b4ffa7b
CISA AA24-038A PRC Critical Infrastructure February 2024ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:S0108
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--02e4c994-181d-4aaf-801b-a56ab36a1aaa
CISA AA24-038A PRC Critical Infrastructure February 2024 · Microsoft Volt Typhoon May 2023 · Joint Cybersecurity Advisory Volt Typhoon June 2023ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:S0029
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0396cca6-52e9-4553-8fa2-68d482c76ddd
CISA AA24-038A PRC Critical Infrastructure February 2024ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0925dc87-1a47-4248-ad5b-316f5a1ce22a
CISA AA24-038A PRC Critical Infrastructure February 2024ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1591.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0afdaf77-82f3-45ce-9316-fa240b51d3b0
CISA AA24-038A PRC Critical Infrastructure February 2024ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0ffa13fd-ca80-4541-a166-9c297145180d
CISA AA24-038A PRC Critical Infrastructure February 2024 · Secureworks BRONZE SILHOUETTE May 2023 · Microsoft Volt Typhoon May 2023ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1021.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--127fc875-b87c-46eb-94d8-364486710ad4
CISA AA24-038A PRC Critical Infrastructure February 2024ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1584.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--12948e09-2774-4b91-b9d1-018b41f7f923
CISA AA24-038A PRC Critical Infrastructure February 2024 · Secureworks BRONZE SILHOUETTE May 2023ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1090
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1542332b-788b-4c1e-b5e5-69d032cb7814
CISA AA24-038A PRC Critical Infrastructure February 2024 · Microsoft Volt Typhoon May 2023 · Joint Cybersecurity Advisory Volt Typhoon June 2023ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1518
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--16ccf88b-5f28-41d3-bc34-6580be0dbe3f
CISA AA24-038A PRC Critical Infrastructure February 2024 · Joint Cybersecurity Advisory Volt Typhoon June 2023ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:S0100
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--18a2df13-e78e-46ca-9074-17c97d19ad55
Joint Cybersecurity Advisory Volt Typhoon June 2023ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1078
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1cc1f98f-5537-40bf-9693-e11e74a0332f
CISA AA24-038A PRC Critical Infrastructure February 2024ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1584.008
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1e81cdcc-e258-479f-9588-3649509bfcd1
Microsoft Volt Typhoon May 2023 · Joint Cybersecurity Advisory Volt Typhoon June 2023ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1056.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1f02b84e-b79e-402f-b1c1-3f5b5c8bc8c6
CISA AA24-038A PRC Critical Infrastructure February 2024ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1036.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--20384b7e-e720-44ed-9aea-7f6857ce18c1
CISA AA24-038A PRC Critical Infrastructure February 2024 · Secureworks BRONZE SILHOUETTE May 2023 · Joint Cybersecurity Advisory Volt Typhoon June 2023ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1036.008
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--21b87986-57d0-45a7-9a42-f3e7803cf337
Secureworks BRONZE SILHOUETTE May 2023ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--261d9569-d779-4f76-a7e3-6f704afc8185
CISA AA24-038A PRC Critical Infrastructure February 2024 · Secureworks BRONZE SILHOUETTE May 2023 · Microsoft Volt Typhoon May 2023 · Joint Cybersecurity Advisory Volt Typhoon June 2023ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--284eb222-c310-480c-aaaa-82c1d5c64e62
CISA AA24-038A PRC Critical Infrastructure February 2024 · Secureworks BRONZE SILHOUETTE May 2023ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1555
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--29f40ca0-8255-44f3-afea-8facfd150314
Joint Cybersecurity Advisory Volt Typhoon June 2023ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1074
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2f9e7f23-979c-4d7f-a19c-907dc94504aa
Microsoft Volt Typhoon May 2023ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:S0645
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--30a53a55-718d-4108-9063-45dc9bfacc93
CISA AA24-038A PRC Critical Infrastructure February 2024 · Joint Cybersecurity Advisory Volt Typhoon June 2023ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1590
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--34558338-caef-4e28-8512-8f42746dd256
CISA AA24-038A PRC Critical Infrastructure February 2024ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1560.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3d6d5bc0-2160-4152-9a4b-b2f19a8768b4
CISA AA24-038A PRC Critical Infrastructure February 2024 · Secureworks BRONZE SILHOUETTE May 2023ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3e0fc6a8-83df-41da-ac13-0e37e4cfe89f
CISA AA24-038A PRC Critical Infrastructure February 2024ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1069.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3e17459a-edb2-471c-87b0-1315f3500ab6
Secureworks BRONZE SILHOUETTE May 2023ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3ee66a23-0783-4292-b4be-cc227932800c
Joint Cybersecurity Advisory Volt Typhoon June 2023ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1018
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--40356b61-2279-47ef-b7bd-4b355e2fb98a
Secureworks BRONZE SILHOUETTE May 2023 · Microsoft Volt Typhoon May 2023ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1047
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--40b2270c-1549-44dc-87b2-d263941eb951
CISA AA24-038A PRC Critical Infrastructure February 2024 · Secureworks BRONZE SILHOUETTE May 2023 · Microsoft Volt Typhoon May 2023 · Joint Cybersecurity Advisory Volt Typhoon June 2023ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1133
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--419745f1-4065-4aad-bf90-ffe198562bd8
CISA AA24-038A PRC Critical Infrastructure February 2024ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--42f5a98f-bf34-4b60-ac0c-dfca896c8235
Secureworks BRONZE SILHOUETTE May 2023ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1570
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4893fd0f-c256-4b74-a3d8-aef48794550a
Secureworks BRONZE SILHOUETTE May 2023ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:S1154
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--49d855a1-c53c-4a96-a25c-d746964b7d37
Lumen Versa 2024ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1593
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--50ffe9ed-aaf1-4b82-9dea-b15c2cb07225
CISA AA24-038A PRC Critical Infrastructure February 2024ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1680
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--514a384a-2b09-4b4f-9def-8e4007b49734
CISA AA24-038A PRC Critical Infrastructure February 2024 · Secureworks BRONZE SILHOUETTE May 2023 · Microsoft Volt Typhoon May 2023 · Joint Cybersecurity Advisory Volt Typhoon June 2023ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1589.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--55fd3f18-99b6-4c95-a2f3-e28962d73a91
CISA AA24-038A PRC Critical Infrastructure February 2024ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1497.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--56889f30-eb6c-4286-b25a-39d35f93a1c0
Microsoft Volt Typhoon May 2023ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1003.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--582f4641-f68d-4dad-96e0-eb4da4128bbf
CISA AA24-038A PRC Critical Infrastructure February 2024 · Secureworks BRONZE SILHOUETTE May 2023 · Microsoft Volt Typhoon May 2023 · Joint Cybersecurity Advisory Volt Typhoon June 2023ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1027.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--59b6b4e2-f2fe-4d81-b85c-1fe6c8102eba
CISA AA24-038A PRC Critical Infrastructure February 2024ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1573.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5a347320-15ce-40b9-8b9f-05f7c0c3ff9c
Secureworks BRONZE SILHOUETTE May 2023ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1003.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5c96f40f-8cbc-4561-9a1f-ce9dad5808d5
CISA AA24-038A PRC Critical Infrastructure February 2024 · Microsoft Volt Typhoon May 2023ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1685.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5d9e27b1-3e1d-46df-9d01-c925789206fa
CISA AA24-038A PRC Critical Infrastructure February 2024ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1584.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5f7da78d-8d46-43db-945d-14bdc316d504
CISA AA24-038A PRC Critical Infrastructure February 2024ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1592
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5fc4e1c8-69f4-4bf6-bcd3-6a02e9547f61
CISA AA24-038A PRC Critical Infrastructure February 2024ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--643a223a-76fa-4a34-9197-3acbc5aff205
Secureworks BRONZE SILHOUETTE May 2023 · Joint Cybersecurity Advisory Volt Typhoon June 2023ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1087.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--648a19d0-2728-4be8-ac62-4bf08a4265a6
CISA AA24-038A PRC Critical Infrastructure February 2024ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1217
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--64e03a61-21a6-40d6-9c87-30c1f21ba899
CISA AA24-038A PRC Critical Infrastructure February 2024ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:S0057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6784ef17-912c-4319-87b4-4279c8b663b3
CISA AA24-038A PRC Critical Infrastructure February 2024 · Secureworks BRONZE SILHOUETTE May 2023 · Joint Cybersecurity Advisory Volt Typhoon June 2023ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--68019421-95db-4416-879d-bb68c063dd78
CISA AA24-038A PRC Critical Infrastructure February 2024 · Microsoft Volt Typhoon May 2023 · Joint Cybersecurity Advisory Volt Typhoon June 2023ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1654
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6848a6be-5571-4e88-b95d-45d9a11d4758
CISA AA24-038A PRC Critical Infrastructure February 2024 · Joint Cybersecurity Advisory Volt Typhoon June 2023ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1068
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--736a8636-78f7-4ed7-80d4-73602eb32768
CISA AA24-038A PRC Critical Infrastructure February 2024ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1113
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--77fcf452-80a6-4922-99fa-896fe68a8c8a
CISA AA24-038A PRC Critical Infrastructure February 2024ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1090.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--828d0030-009d-4612-ae30-9dfa3d139e26
CISA AA24-038A PRC Critical Infrastructure February 2024 · Microsoft Volt Typhoon May 2023ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:S0002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8329b484-4c42-4c30-8565-a742bff07b0c
CISA AA24-038A PRC Critical Infrastructure February 2024 · Joint Cybersecurity Advisory Volt Typhoon June 2023ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1587.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--88342067-1634-4ffb-8b77-4533952d6bb7
CISA AA24-038A PRC Critical Infrastructure February 2024ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1090.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--91a1d7fc-8057-4b7d-bef5-9c92612e4fe5
CISA AA24-038A PRC Critical Infrastructure February 2024ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1594
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--93150c1f-25b3-47b9-8327-dbaf97b6d2d3
CISA AA24-038A PRC Critical Infrastructure February 2024ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1033
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--93965fb7-e50d-45c8-a0db-354ce8ee05b8
CISA AA24-038A PRC Critical Infrastructure February 2024 · Secureworks BRONZE SILHOUETTE May 2023 · Joint Cybersecurity Advisory Volt Typhoon June 2023ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1112
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--97b0f29c-343d-40fc-a37f-85d65ed26ba6
CISA AA24-038A PRC Critical Infrastructure February 2024ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1505.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9ca80e08-f365-48c6-bb40-24657614b217
Secureworks BRONZE SILHOUETTE May 2023ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1218
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9d201e67-fc71-41a1-9d92-b8d743d86a12
CISA AA24-038A PRC Critical Infrastructure February 2024ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1059.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a73b2e1c-fb14-4e1f-bbe2-b216bb38c694
CISA AA24-038A PRC Critical Infrastructure February 2024ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:S0097
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ad6cad0b-d827-4182-baf9-826c6788cf4e
CISA AA24-038A PRC Critical Infrastructure February 2024 · Microsoft Volt Typhoon May 2023ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ad6fdc42-3f34-4412-b1a8-3af6728917f7
CISA AA24-038A PRC Critical Infrastructure February 2024ATTACK:enterprise:C0039 → attributed-to → ATTACK:enterprise:G1017
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b109514b-66b3-4c06-8b1d-4f89e1f2cfde
Lumen Versa 2024ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1069
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b14326e4-f40d-416d-9b19-268be395de4b
CISA AA24-038A PRC Critical Infrastructure February 2024ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1584.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b2f3bf33-8e22-4ab4-9358-3fda32cbea55
CISA AA24-038A PRC Critical Infrastructure February 2024ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1555.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b620d7cd-34ef-402c-b8c2-e36c27162c63
CISA AA24-038A PRC Critical Infrastructure February 2024ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1591
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b7e572db-2657-4d7e-aa58-885dc7f32057
CISA AA24-038A PRC Critical Infrastructure February 2024ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1590.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bb499e95-45c2-474b-a914-5b7f0604863a
CISA AA24-038A PRC Critical Infrastructure February 2024ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1010
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bc681eea-c32c-4cc1-80a6-efd759da8bb9
CISA AA24-038A PRC Critical Infrastructure February 2024ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1069.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c08d8f49-5cca-4463-81db-bb80cc9a7af6
Joint Cybersecurity Advisory Volt Typhoon June 2023ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1120
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c1632c73-7043-4aef-89f6-abbf6af676d2
CISA AA24-038A PRC Critical Infrastructure February 2024ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1070.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c4d3d8d6-95a9-4d1d-bd51-ad736c0a4b41
CISA AA24-038A PRC Critical Infrastructure February 2024 · Secureworks BRONZE SILHOUETTE May 2023ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:S0357
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c93cacac-5ecf-49cb-8377-18e319545329
CISA AA24-038A PRC Critical Infrastructure February 2024 · Microsoft Volt Typhoon May 2023 · Joint Cybersecurity Advisory Volt Typhoon June 2023ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1588.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c9b4b56c-177d-446b-b34b-4e12c35304f2
CISA AA24-038A PRC Critical Infrastructure February 2024ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ce2b3395-efd0-4ac8-9c52-69a571b66609
CISA AA24-038A PRC Critical Infrastructure February 2024ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1552
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d0718f47-ad79-4d04-a9d9-7bc97371a947
CISA AA24-038A PRC Critical Infrastructure February 2024ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:S0096
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d3269fe9-f90f-4714-bee5-836072e9ad6f
CISA AA24-038A PRC Critical Infrastructure February 2024 · Secureworks BRONZE SILHOUETTE May 2023 · Joint Cybersecurity Advisory Volt Typhoon June 2023ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1078.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d51a3ee4-4542-4334-9989-249aa107c261
CISA AA24-038A PRC Critical Infrastructure February 2024 · Secureworks BRONZE SILHOUETTE May 2023 · Microsoft Volt Typhoon May 2023ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d5f428f5-4c16-495e-bc79-882a92ce75e0
CISA AA24-038A PRC Critical Infrastructure February 2024 · Secureworks BRONZE SILHOUETTE May 2023 · Joint Cybersecurity Advisory Volt Typhoon June 2023