Also known as: VANGUARD PANDA, Bronze Silhouette, DEV-0391, Insidious Taurus, UNC3236, Redfly, Storm-0391, VOLTZITE
Exploit Public-Facing Application
Exploit vulnerabilities in internet-facing applications to gain access.
External Remote Services
Abuse remote services like VPNs or RDP to gain access to the network.
Valid Accounts
Use legitimate credentials to authenticate and gain access.
Drive-by Compromise
Gain access through a user visiting a compromised website during normal browsing.
T1218.011
T1003.003
T1016
T1049
T1057
T1090.002
T1584.008
T1112
T1090.001
T1584.004
T1027.002
T1021.004
T1069.002
T1087.002
T1560.001
T1136.001
T1136.002
T1505.003
T1550.002
T1550.003
T1021.006
T1036.004
T1053.005
T1072
T1592.002
T1588.002
T1003.002
T1070.004
T1033
T1135
T1201
T1482
T1095
T1020
T1053.002
T1071.001
T1071.004
T1098
T1114.002
T1199
T1210
T1498
T1518
T1543.003
T1562.001
T1563.002
T1036.005
T1078.001
T1119
T1187
T1505
T1556.001
Ingress Tool Transfer
Download additional tools or payloads from an external system.
Remote Access Software
Use legitimate remote access tools like TeamViewer or AnyDesk for C2.
Application Layer Protocol
Communicate using application layer protocols like HTTP, DNS, or SMTP.
Proxy
Route C2 traffic through intermediary proxies to obscure the source.
Primary tool for reconnaissance and command execution. Used with encoded commands to query AD, enumerate network shares, and gather system information without deploying malware.
Windows utility abused to create snapshots of the Active Directory database (NTDS.dit) for offline credential extraction and domain-wide access.
Used to configure port proxying and firewall rules on compromised systems, enabling traffic forwarding through operational relay networks.
Windows Management Instrumentation CLI used for remote process execution, system enumeration, and lateral movement without deploying additional tools.
Abused for file transfers (downloading tools from C2), Base64 encoding/decoding, and certificate manipulation on compromised systems.
Active Directory utility used to export directory data for offline analysis, mapping organizational structure and identifying high-value targets.
Open-source reverse proxy tool used to create encrypted tunnels from compromised networks to external C2 infrastructure, often with modified binaries.
Python toolkit used for wmiexec remote execution, secretsdump credential extraction, and SMB relay attacks during lateral movement phases.
Deployed sparingly for credential extraction. Volt Typhoon prefers NTDS.dit offline extraction to avoid triggering LSASS memory access alerts.
SOCKS5 proxy tool used to create multi-hop tunnels through compromised systems, enabling access to isolated network segments.
Command interpreter used to chain living-off-the-land binaries, execute batch scripts for reconnaissance, and manage compromised SOHO router access.
Compromises Fortinet FortiGuard, ASUS, Cisco, D-Link, Netgear, and Zyxel routers to create operational relay box (ORB) networks that proxy C2 traffic.
Network scanning tool used for initial reconnaissance of target infrastructure, port scanning, and service enumeration of critical infrastructure networks.
GUI-based network scanner used to map internal network topology, identify live hosts, and discover shared resources on compromised networks.
Sysinternals utility used for remote command execution on Windows systems. Enables lateral movement using harvested credentials.
Registry command-line tool used to query and modify registry keys for persistence, disabling security features, and extracting cached credentials.
Legitimate reverse proxy tool abused for command and control
NTLM relay attack tool used for credential relay attacks
Post-exploitation framework occasionally used for command execution
Open-source reverse proxy tool used to establish C2 channels
Windows Management Instrumentation used for system management and lateral movement
| Type | Value |
|---|---|
| ip | 104[.]161[.]54[.]203 |
| ip | 185[.]106[.]92[.]12 |
| domain | gosloede[.]com |
| hash | baeffeb5fdef2f42a752c65c2d2a52e84fb57efc906d981f89dd518c314e231c |
| Domain / Host | Status |
|---|---|
104[.]161[.]54[.]203Compromised SOHO router used as relay infrastructure | offline |
185[.]106[.]92[.]12Operational relay box (ORB) infrastructure | offline |
gosloede[.]comC2 domain identified in critical infrastructure targeting | offline |
Infrastructure data reflects monitoring status only — no raw fingerprint data is exposed.
Microsoft - Volt Typhoon targets US critical infrastructure
https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/
CISA - PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure
https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-038a
CrowdStrike - VANGUARD PANDA
https://www.crowdstrike.com/blog/falcon-complete-thwarts-vanguard-panda-tradecraft/
Dragos 2026 OT/ICS Cybersecurity Year in Review - VOLTZITE Elevated to Stage 2
https://www.dragos.com/resources/press-release/dragos-2026-year-in-review-new-ot-threats-ransomware
Volt Typhoon Maintained Access to Massachusetts Utility for 10 Months - The Record
https://therecord.media/volt-typhoon-hackers-utility-months
Microsoft Threat Intelligence - Volt Typhoon Targets US Critical Infrastructure
https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques
Dragos: Researchers Warn Volt Typhoon Still Embedded in US Utilities - The Record
https://therecord.media/researchers-warn-volt-typhoon-still-active-critical-infrastructure
CISA Cybersecurity Advisory - PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-144a
NSA/FBI Joint Cybersecurity Advisory - People's Republic of China State-Sponsored Cyber Actor Living off the Land to Evade Detection
https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF
Secureworks - Bronze Silhouette Targets US Critical Infrastructure
https://www.secureworks.com/research/bronze-silhouette-targets-us-critical-infrastructure
Volt Typhoon - MITRE ATT&CK Group Profile
https://attack.mitre.org/groups/G1017/
Volt Typhoon: Analyzing Windows Proxy Logon Attack Targeting Hybrid Identity
https://www.sentinelone.com/labs/volt-typhoon-analyzing-windows-proxy-logon-attack-targeting-hybrid-identity/
Assessing Volt Typhoon's Capabilities and Operations
https://www.secureworks.com/blog/assessing-volt-typhoons-capabilities-and-operations
NCSC-NL Advisory: Volt Typhoon
https://www.ncsc.nl/actueel/advisory?id=NCSC-2024-0038
FBI and Partners Issue Advisory on Volt Typhoon Activity
https://www.fbi.gov/news/press-releases/fbi-and-partners-issue-advisory-on-volt-typhoon-activity
Secureworks: Volt Typhoon Exploits Zero-Day Vulnerability
https://www.secureworks.com/blog/volt-typhoon-exploits-zero-day-vulnerability
BlackLotus campaign: Analyzing the technical tactics of Volt Typhoon
https://www.secureworks.com/research/bronze-silhouette
Assessing the Tradecraft and Impact of the Volt Typhoon Intrusions
https://www.mandiant.com/resources/blog/volt-typhoon-tradecraft-us-critical-infrastructure
Singapore Names UNC3886 APT Targeting Critical Infrastructure - July 2025
https://en.wikipedia.org/wiki/Volt_Typhoon
Australia Warns of Volt Typhoon Infrastructure Targeting - November 2025
https://en.wikipedia.org/wiki/Volt_Typhoon
FBI KV Botnet Disruption - January 2024
https://therecord.media/china-run-botnet-takedown-fbi-doj-routers
Volt Typhoon Rebuilds KV Botnet After FBI Takedown - November 2024
https://www.bleepingcomputer.com/news/security/volt-typhoon-rebuilds-malware-botnet-following-fbi-disruption
NSA/FBI Joint Cybersecurity Advisory on Volt Typhoon
https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/joint_csa_protecting_against_prc_state_sponsored_cyber_activity.pdf
Black Lotus Labs: Volt Typhoon RCE Exploit Infrastructure Analysis
https://blog.lumen.com/volt-typhoon-rce-exploit-infrastructure/
Secureworks: Volt Typhoon Targets Critical Infrastructure
https://www.secureworks.com/blog/volt-typhoon-targets-critical-infrastructure
FBI Director Wray testimony on Volt Typhoon targeting critical infrastructure
https://www.fbi.gov/news/speeches/countering-threats-posed-by-the-chinese-government-inside-the-us-wray-013124
Secureworks: VOLTZITE Threat Profile
https://www.secureworks.com/research/threat-profiles/bronze-silhouette