Atlas Actors Sectors Requirements

⌘K

Atlas Actors Sectors Requirements

LOADING

Volt Typhoon (aka VOLTZITE, Dev-0391) · APT Atlas

Actors/Nation-state / APT/Asia

Volt Typhoon

APTCN · China

AKA VOLTZITE · Dev-0391 · INSIDIOUSTAUR

CrowdStrike: VANGUARD PANDAMandiant: UNC3236Secureworks: BRONZE SILHOUETTE

PRC cluster targeting US critical infrastructure with living-off-the-land techniques.

Targets1

Sectors12

Threat types1

GIRs covered0/480

Active since2021

QUICK FACTS

TypeNation-state / APT

OriginChina

First seen2021

Type (verbatim)nation-state APT

GIR coverage0/480

TTPs57

Targets1

Sectors12

Victimology

Geographic footprint · 1 countries

origin · Chinatargeted countries · 1

AMERICAS · 1

Sectors targeted

12 of 40

Government83 actors Defense60 actors Aviation19 actors Technology51 actors Telecom57 actors Energy / Utilities49 actors Oil and Gas19 actors Education & Research50 actors Manufacturing (man)40 actors Transportation25 actors Logistics18 actors Maritime21 actors

Tactics, techniques, procedures

Threat types + MITRE ATT&CK mapping

THREAT TYPES

ESP · Espionage

MITRE ATT&CK · 57 techniques

Reconnaissance · 8

T1589.002Email Addresses T1590Gather Victim Network Information T1591Gather Victim Org Information T1591.004Identify Roles T1592Gather Victim Host Information T1593Search Open Websites/Domains T1594Search Victim-Owned Websites T1596.005Scan Databases

Initial Access · 1

T1190Exploit Public-Facing Application

Execution · 4

T1047Windows Management Instrumentation

Privilege Escalation · 1

T1068Exploitation for Privilege Escalation

Credential Access · 6

T1003.001LSASS Memory

Discovery · 18

T1007System Service Discovery T1010Application Window Discovery T1012Query Registry

Lateral Movement · 2

T1021.001Remote Desktop Protocol T1570Lateral Tool Transfer

Collection · 4

T1005Data from Local System T1074Data Staged T1113Screen Capture

Command And Control · 4

T1090Proxy T1090.001Internal Proxy

Defense Impairment · 1

T1112Modify Registry

Stealth · 8

T1027.002Software Packing T1036.005Match Legitimate Resource Name or Location

GIR coverage

0 / 480 requirements satisfied

No GIRs mapped yet for this actor.

Related actors

By origin and actor type

APT2nation-state

China · 6 targets · since 2010

APT5nation-state

China · 15 targets · since 2007

APT8nation-state

China · 5 targets · since —

APT14nation-state

China · 15 targets · since —

APT17nation-state

China · 10 targets · since 2009

APT20nation-state

China · 14 targets · since 2011

T1059.001

PowerShell

T1059.003Windows Command Shell

T1059.004Unix Shell

T1003.003

NTDS

T1552Unsecured Credentials

T1552.004Private Keys

T1555Credentials from Password Stores

T1555.003Credentials from Web Browsers

T1016System Network Configuration Discovery

T1018Remote System Discovery

T1033System Owner/User Discovery

T1046Network Service Discovery

T1049System Network Connections Discovery

T1057Process Discovery

T1069.001Local Groups

T1083File and Directory Discovery

T1120Peripheral Device Discovery

T1124System Time Discovery

T1217Browser Information Discovery

T1518Software Discovery

T1614System Location Discovery

T1654Log Enumeration

T1680Local Storage Discovery

T1560.001

Archive via Utility

T1090.003

Multi-hop Proxy

T1105Ingress Tool Transfer

T1036.008

Masquerade File Type

T1070.004File Deletion

T1078Valid Accounts

T1078.002Domain Accounts

T1140Deobfuscate/Decode Files or Information

T1218System Binary Proxy Execution