Volt Typhoon left little to scan for, so agencies had to know their own normal

The week

On May 24, 2023, Microsoft reported that a state-sponsored actor based in China, which it called Volt Typhoon, had been active since mid-2021 against critical infrastructure organizations in Guam and elsewhere in the United States. Targets spanned communications, manufacturing, utilities, transportation, construction, maritime, government, information technology and education. “Critical infrastructure” is the term for the systems a society runs on: power, water, ports, phone networks, transit and the public agencies that oversee them.

Most people expect a cyberattack to be loud: a ransom note on every screen, a website knocked offline, a leak of customer records. This one was the opposite. The intruders had been patient and almost invisible, and appeared to be waiting.

The same day, the NSA, CISA and the FBI, with cybersecurity agencies in Australia, Canada, New Zealand and the United Kingdom, published a joint advisory. (CISA, the Cybersecurity and Infrastructure Security Agency, is the federal agency charged with helping protect civilian networks and infrastructure.) A six-country advisory on the same day as a vendor report is a signal that governments considered the matter serious.

The advisory was practical in a way few government documents are. It listed the commands the actor had run, such as wmic, ntdsutil, netsh, vssadmin, certutil and xcopy, all built into Windows. It also named open-source tools seen in the activity, including Earthworm, a modified Fast Reverse Proxy client, Impacket and Mimikatz. It cited the exploitation of known flaws in ManageEngine ADSelfService Plus and FatPipe WARP. And it warned that many of the listed indicators could appear in ordinary administration, so defenders should not treat a match as proof of compromise.

Its logging advice was specific. It asked defenders to switch on process creation auditing with full command lines, deeper PowerShell logging and WMI tracing, several of which are off by default in Windows. It pointed to particular Windows event records that reveal copying of the directory database and the clearing of audit logs. It also recommended sending logs to a hardened central server, out of the intruder’s reach.

Both described “living off the land.” Instead of bringing in custom malicious software, which security tools are designed to spot, the intruders used legitimate tools built into Windows and network devices. It is the difference between a burglar who brings a crowbar and one who uses the house’s own keys, ladder and toolbox. Nothing looks out of place, because nothing foreign was brought in.

Microsoft said the actor gained initial access through internet-facing Fortinet devices, a brand of security appliance that sits at the boundary between an organization’s network and the internet. It routed its traffic through compromised small office and home office routers, the kind of box that sits in a spare room or a dentist’s back office. That made its connections look like they came from ordinary American homes and businesses.

The details mattered for defenders. Microsoft said the intruders used the privileges of the compromised Fortinet device to extract credentials for an Active Directory account, then used them to sign in elsewhere on the network. How they first got into those devices was still under investigation. The relay routers came from several manufacturers, including ASUS, Cisco, D-Link, NETGEAR and Zyxel, and many exposed their management pages to the internet. Microsoft said it had notified targeted or compromised customers and published detection queries.

Microsoft described the actor’s aims as espionage and keeping access for as long as possible without being detected. Its recommended defenses were familiar: keep the management interfaces of routers, firewalls and VPN appliances off the public internet, and use strong multi-factor authentication. It also recommended protecting the Windows process that holds sign-in credentials, and resetting the credentials of any compromised account.

The context made the report land harder. In March 2023 the White House had published a National Cybersecurity Strategy that called for minimum security requirements in critical infrastructure. That same month the Environmental Protection Agency had told states to evaluate cybersecurity at public water systems during their periodic sanitary surveys. Several states had challenged that approach in court. Water and other locally run sectors were therefore already arguing about who should pay for basic security when the report appeared. China’s foreign ministry rejected the findings as a disinformation campaign.

The most sobering line came last. Microsoft assessed with moderate confidence that the campaign was developing capabilities that could disrupt critical communications between the United States and Asia during a future crisis. Officials described it as preparation rather than theft for its own sake.

The advisory was unusual for what it told defenders not to expect. There was little malware to scan for and few indicators that would stay useful for long. (An “indicator” is a telltale clue, such as a known malicious file or internet address, that security tools can search for automatically.) The intruders used the command-line tools, administrative accounts and remote access methods that IT staff use every day.

They entered through edge devices that many organizations monitor poorly, and their traffic arrived from ordinary US home routers. For state and local agencies, water and power utilities, ports and transit authorities, this created three separate problems: knowing what normal administrative activity looks like, owning the network edge, and planning to keep services running on a network that cannot be trusted.

The rules that frame these problems differ sharply by type of organization. Federal civilian agencies are bound by OMB memoranda and CISA binding operational directives, which set logging and patching expectations. State and local agencies generally are not. Community water systems serving more than 3,300 people must prepare risk and resilience assessments under the America’s Water Infrastructure Act of 2018. NERC’s critical infrastructure protection standards govern the bulk power system but reach few of the smallest municipal distribution utilities. Pipelines and rail operate under TSA security directives, and ports under Coast Guard maritime security rules. The adversary treated them all alike; their obligations were not alike.

Why “living off the land” is so hard to catch

Much of traditional cybersecurity looks for known dangerous objects. Antivirus software compares files against a catalog of known malicious code; network filters block addresses that have been seen doing harm. That model works well against criminals who reuse the same tools.

Living off the land sidesteps it. The tools in use are the ones the organization installed itself and relies on every day. The command line is a text window where administrators type instructions directly to a computer, rather than clicking through menus. PowerShell is Microsoft’s powerful scripting version of that window, used to automate routine administration. Active Directory is the central register of a Windows network: it holds every user account, every password record and every permission. Whoever controls it effectively controls the organization’s computers.

These tools cannot be switched off. They are how IT departments do their jobs. So the question shifts from “is something dangerous present?” to “is someone using normal tools in an abnormal way?” That is a much harder question, and it can only be answered by an organization that knows what its own normal looks like.

Why the usual indicators expire

Threat intelligence feeds deal mostly in indicators: hashes of malicious files, malicious domains and the internet addresses of attacker servers. Volt Typhoon produced few of the first two. Its addresses belonged to hijacked home and office routers, which changed as devices were rebooted, replaced or abandoned. An address that was malicious last month might be a dentist’s router again this month. Blocking lists built on such addresses age within weeks and can block legitimate customers.

The joint advisory acknowledged this directly. It warned that many of its indicators were legitimate administrative commands, and that matches needed investigation before anyone treated them as malicious. A defender who ran the list against a busy Windows estate would get many matches. The useful work was in deciding which matches nobody could explain.

What the intruders wanted from the directory

Two targets explain much of the activity. The first is the memory of the Windows process called LSASS, which handles sign-ins and holds credential material for users who have logged on. Dumping that memory can yield passwords or password hashes. The second is the Active Directory database file, ntds.dit, which holds password hashes for every account in the domain. Because the file is locked while the server runs, intruders use tools such as ntdsutil or Volume Shadow Copy to make a copy.

With the copy, they can crack passwords offline, out of sight of any monitoring. They can then sign in as real users, including administrators, for as long as those passwords stay unchanged. That is why a single unexplained copy of the directory database is a high-severity event, and why recovery usually means resetting every privileged credential, often twice.

How such an intrusion might unfold

Suppose the target were a regional water authority. What follows is a simplified picture of the general pattern the advisories described, not a reconstruction of any real victim.

First, an intruder finds a weakness in the firewall that connects one of the authority’s offices to the internet. The device is doing its job, so nobody is looking at it closely. Second, the intruder logs in using a real account, perhaps one whose password was harvested along the way. To the network, this looks like an employee. Third, the intruder uses the built-in administrative tools to look around: which servers exist, who the administrators are, where the important systems live. Fourth, it copies the directory database, which gives it the means to impersonate other users later. Throughout, its connections arrive via a hijacked router in someone’s home a few states away.

At no point does an alarm built to detect malicious software have anything to detect. The only traces are entries in logs, if the logs are being kept, and the only way to recognize those entries as suspicious is to know that nobody at the authority planned that work. Even then, the authority would need someone to look at the right entry within weeks, before the logs roll over. So the defenses that matter lie in context, the edge and continuity, more than in new detection products.

Knowing normal administrative activity

The joint advisory listed the kinds of commands defenders should hunt for. They included using the built-in ntdsutil utility to copy the Active Directory database, using netsh to set up port forwarding, and running Windows Management Instrumentation queries to survey systems. Translated, that means copying the master record of accounts and passwords, rerouting network traffic through a side door, and taking an inventory of what is on the network.

Every one of these is something an administrator might legitimately do. No signature can separate the intruder from the employee. Only context can: who ran the command, on which system, at what time, and whether anyone planned it.

That context depends on logging many organizations had not switched on. A log is a computer’s running record of what happened on it. Process creation events with full command lines, PowerShell logging and domain controller security logs are the minimum. (Domain controllers are the servers that run Active Directory.) Retention matters as much as collection. An intruder present for months will not be found in thirty days of logs.

The specific records that matter

The advisory pointed defenders to particular Windows records. Event 4688, with command-line auditing switched on, records each program started and the exact instruction typed. PowerShell script block logging records the scripts that run, even when they are disguised. Certain database engine events in the application log show when the directory database has been copied. Event 1102 shows that someone cleared the security log, which is something intruders do to cover their tracks. Sign-in events 4624 and 4625 show successful and failed logons.

Free tools extend this. Microsoft’s Sysmon adds richer records of processes and network connections. Edge devices, VPN appliances and firewalls produce their own logs, which should go to the same central store. Network flow records, showing which systems talked to which, help reconstruct an intruder’s path when host logs are missing.

Retention is a budget decision. Federal agencies have a benchmark in M-21-31, which calls for many log types to be kept for 12 months in active storage and a further 18 months in cold storage. Most local governments cannot afford that across everything. A sensible compromise keeps domain controller, VPN, edge device and privileged account logs for at least a year, and accepts shorter retention for noisier sources. Cheap cold storage makes the long tail affordable, provided someone has tested that it can be searched.

The most practical baseline is change management, the ordinary business process by which planned IT work is requested, approved and recorded in a ticket. Copying the directory database should be rare and always tied to a ticket. A rule that alerts on directory copies, new port forwarding or new remote access outside an approved change window catches the misuse that matters most. It also produces few enough alerts for a small team to review.

Over time the same approach extends to other rare administrative actions. Each one becomes a matched pair of a ticket and a log entry, and an unmatched entry is a lead. Take a county IT office of four people with no dedicated security analyst. It cannot watch every event, but it can set an alert for a handful of rare actions and ask, each time one fires, “Is there a ticket for this?” Most weeks the answer is yes. The week the answer is no is the week that matters.

Small shops raise a fair objection: their change tickets are incomplete, and emergency fixes often happen first and get written down later, if at all. The answer is to accept after-the-fact tickets, within a day, but to insist that every rare administrative action ends up with one. An alert that fires on an action with no ticket after 24 hours is still valuable. Over a few months, the discipline also improves the change records the organization needs for its own audits.

The starting list can be short. It might include any directory database copy or shadow copy on a domain controller, any new port forwarding rule and any cleared security log. Others are new remote desktop sessions to domain controllers from workstations, and interactive sign-ins by service accounts. Each item is rare in a well-run network, and each one was part of the pattern officials described.

Federal agencies had a logging framework in OMB’s 2021 memorandum M-21-31. Most state and local bodies had no equivalent, and many lacked staff to read logs at all. For them the realistic route is a shared service: a state security operations program, a managed detection provider, or the services the Multi-State Information Sharing and Analysis Center offers to state and local governments. A security operations center is, in effect, a monitoring desk staffed by analysts who read alerts around the clock, and sharing one spreads the cost across many small bodies. The agency still has to decide which logs to send and keep the change records the analysts need.

The contract with a managed provider deserves the same care as the technology. It should list the log sources the provider receives and how long the provider keeps them. It should say who owns the data, and whether the agency can get its raw logs back quickly during an incident or when the contract ends. It should set how fast the provider must call, and whom. And it should give analysts access to the change calendar, so they can tell planned work from unplanned work without phoning the agency at 2 a.m. for every alert.

Owning the network edge

The “edge” of a network is where it meets the outside world: the firewalls that filter traffic, the VPN appliances that let staff connect from home, the routers that link offices together. A VPN, or virtual private network, creates a private tunnel over the public internet so a remote worker’s laptop can reach internal systems as if it were in the building. These devices face the internet all day, which makes them the first thing attackers probe.

Two different edges were involved. The first was the victim’s own perimeter: firewalls and VPN appliances facing the internet. The second was other people’s equipment. Volt Typhoon relayed its traffic through compromised home and small office routers, many past the end of vendor support. “End of support” means the manufacturer no longer issues security fixes, so known weaknesses stay open for good. Its connections therefore arrived from residential US addresses, which defeats blocking by country and most reputation lists.

The edge you own

The first edge is the agency’s to fix. Public organizations have more of it than they think: pump stations, substations, libraries, fire stations, small field offices and remote access installed by integrators for control systems. Each of those sites may have its own small box connecting it to the internet, sometimes installed years ago by a contractor and never revisited.

The steps are known. Keep an inventory of every internet-facing device with its owner, firmware level and support status. (Firmware is the built-in software that runs a device; keeping it current is how security fixes are applied.) Set a shorter patch deadline for edge devices than for internal systems, because they are attacked first. Take management interfaces off the internet, so the control panel for a firewall cannot be reached by anyone online. Require multi-factor authentication on remote access, meaning a second proof of identity such as a code on a phone, in addition to a password. Send device logs to central monitoring.

Federal agencies had a deadline for one of these steps soon after the advisory. In June 2023 CISA issued Binding Operational Directive 23-02. It required federal civilian agencies to remove certain networked management interfaces from the public internet, or protect them with zero trust access controls, within 14 days of discovery. Federal agencies were already required by an earlier directive to fix vulnerabilities on CISA’s Known Exploited Vulnerabilities catalog within set deadlines. State and local bodies are not bound by either directive, but the catalog is public and serves as a free priority list for edge patching.

Edge devices also need a known-good configuration. The 2023 advisory recommended reviewing perimeter firewall configurations for unauthorized changes, such as new rules, new accounts or new forwarding. That review is only possible if a saved copy of the approved configuration exists to compare against. Keeping one for every device, updated through change control, turns a vague worry into a quick comparison. When a device is suspected of compromise, the safer course is usually to rebuild it from the vendor’s current software and the saved configuration, rather than trust the running device. Some appliances keep changes in places a routine reboot does not clear.

Credentials stored on the edge

Microsoft’s account contained a detail that deserves more attention than it got. The intruders used privileges on the compromised firewall to extract credentials for an Active Directory account. Edge devices often hold such credentials because they check VPN users against the directory. The account they use to do so may have more rights than it needs, and its password may not have changed in years.

That turns the edge device into a key to the directory. The controls are straightforward. Give any account an edge device uses the narrowest rights possible. Change its password on a schedule and after any device compromise. Alert when that account is used anywhere other than from the device itself. The 2024 follow-up advisory made the same point, recommending that credentials be kept off edge devices where possible.

Finding every device is harder than it sounds. A useful method compares three lists: what an external scan of the organization’s internet addresses shows, what the asset register says, and what purchasing and contracts reveal. Each list catches devices the others miss. Contractors deserve special attention. Integrators who maintain control systems often install their own remote access so they can support equipment from their offices. Contracts should require them to disclose every such path, use multi-factor authentication and accept the agency’s logging.

Replace devices the vendor no longer supports, which usually means a capital request rather than a ticket. This is where executives come in. A request to replace twenty aging routers at remote sites is easy to defer because nothing visibly breaks. It is also one of the clearest, most measurable risk reductions available.

The edge you do not own

The second edge changes detection logic. Many organizations have learned to treat logins from overseas as suspicious and logins from home addresses in their own country as routine. Volt Typhoon turned that habit against them. A login that comes from a domestic residential address is not reassuring by itself. A VPN session for a service account, or an administrator logging in from an address never seen before, deserves review wherever it originates. (A service account is a non-human account that software uses to talk to other software; it should almost never be logging in from a home network.)

Useful signals do not depend on the address. They include a sign-in at an hour the user never works, from a device the organization has never seen, to a system the user never uses. They also include a burst of directory queries from a new account, or an administrator signing in to a domain controller directly from a workstation. Each is cheap to alert on once the baseline exists.

The agency’s own staff create a further wrinkle. Employees working from home connect through their own routers, some of which may be old, unpatched or already part of a relay network. The agency cannot manage those routers. It can require a managed device, a VPN client that checks the device’s health, and phishing-resistant multi-factor authentication, so that a compromised home router sees only encrypted traffic and cannot reuse a password.

Planning to run on an untrusted network

The third problem was intent. Most public-sector continuity plans assume theft of data or ransomware, which makes systems unavailable. Ransomware is malicious software that scrambles an organization’s files and demands payment to restore them. It is disruptive, but it announces itself, and the goal is usually money.

Microsoft’s assessment pointed to an intruder positioned to disrupt at a moment of its choosing. Such an intruder may have watched the network for years and may still be inside it during the response. That is a very different scenario. The people restoring systems may be watched while they do it, and the email used to coordinate the response may be read. That changes the plan in three ways.

First, essential services need a defined manual mode. A water utility should know whether treatment and distribution can run without network control, for how long, and with which staff. A 911 center needs a fallback if computer-aided dispatch is lost. These are the questions a board or city council should be able to get a straight answer to.

Second, operational technology should not depend on the business network for basic operation, so that losing one does not stop the other. Operational technology, or OT, is the equipment that controls physical things: pumps, valves, switches, signals. The business network handles email, payroll and billing. If an intruder in the billing system can also stop the pumps, the two are too closely tied.

Third, incident response needs communications the intruder cannot read, such as out-of-band phones and accounts outside the main directory. “Out-of-band” means using a separate channel that does not run through the compromised network. It also needs a tested way to rebuild the directory from a known clean state. If Active Directory itself cannot be trusted, the organization needs to know it can rebuild its directory from scratch.

What a manual mode requires

A manual mode is a staffing plan more than a technical one. For a water utility it means operators on site at treatment plants and key pump stations, around the clock. They read gauges, adjust chemical dosing and record readings on paper, and someone has to know how to do that safely. It also means enough licensed operators to cover extra shifts for a week or more, and a supply of forms, radios and keys that does not depend on the network.

For a 911 center, it means paper call cards, radio procedures, printed maps and a tested way to transfer calls to a neighboring center. For a transit agency, it may mean running a reduced schedule with manual dispatch. In every case the plan should state what service level is acceptable, for how long, and who decides to switch modes. That decision is hard to make in the middle of an incident unless the triggers are written down in advance.

The coupling between business and control networks is often less visible than leaders assume. The 2024 follow-up advisory described a water sector victim whose virtualization management server sat next to its control systems. From it, the intruders could reach stored sessions for water treatment plants, wells and an electrical substation. Shared virtualization hosts, shared administrator accounts and engineering laptops that move between networks all create links of this kind. Finding them takes a walk-through with operators as well as a network diagram.

Communicating and calling for help

Out-of-band communication has to exist before the incident. That means a short list of response team members with phones and accounts that do not depend on the organization’s directory or email. It also means printed contact lists, including vendors, the state security office, the local FBI field office and CISA. A separate messaging workspace, set up in advance and tested twice a year, is cheap. Building one in the middle of a compromise, while unsure what the intruder can see, is slow and risky.

The plan should also say who decides to bring in outside responders and law enforcement, and who preserves evidence. With an intruder that may have been present for years, evidence from edge devices and domain controllers is often the only way to establish scope. Rebuilding first and investigating later can destroy it.

Rebuilding the directory

Rebuilding Active Directory from a clean state is a known but rarely practiced procedure. It needs offline backups of domain controllers that the intruder could not have altered, a documented recovery sequence and administrators who have done it in a lab. It also needs a plan for resetting every privileged password and the special account that signs Kerberos tickets, usually twice, in the right order. Organizations that separate administrator accounts by tier, so that a workstation administrator cannot sign in to a domain controller, limit how far a stolen credential travels and how much must be rebuilt.

Where a small utility should start

Most US critical infrastructure is run by local governments, cooperatives and small companies with thin security staff. They cannot do everything at once. A sound order is to know every internet-facing device and retire the unsupported ones. Next, log administrative activity somewhere it will be read. Then write down how the most essential service would run for a week without the network. Then test one part of that plan each year.

Federal agencies start from a different baseline. An executive order in May 2021 directed them to deploy endpoint detection and response tools and to improve logging, and the Continuous Diagnostics and Mitigation program provides shared tooling and dashboards. Their gaps tend to be in coverage and in tying alerts to context. A county or a small utility often starts with no endpoint detection at all, so its first purchases and its first habits have to be chosen carefully.

Free and shared help

Small bodies have more outside help than many use. CISA offers free vulnerability scanning of internet-facing systems to state, local, tribal and territorial governments and to critical infrastructure operators, which gives a running external view of the edge. The State and Local Cybersecurity Grant Program, created by the 2021 infrastructure law, made about $1 billion available over four years, with states passing much of it to local governments. State security offices and regional water and electric associations often run shared monitoring or training programs.

Outside help has limits. A scanning service can list exposed devices but cannot replace them. A shared monitoring center can raise an alert but cannot say whether the action was planned unless the agency’s change records are available. And grant money usually arrives once, while log storage, device replacement and staff time recur every year.

A well-prepared utility can produce, on request, a list of every device facing the internet with its owner and support date. It alerts on a short list of rare administrative actions and checks each against a ticket, keeps logs long enough to look back a year, and has walked its operators through a day of manual running.

The failures are just as recognizable:

• Buying another scanning tool and assuming it will catch an intruder who brings nothing to scan for.
• Collecting logs but keeping them for weeks, or sending them somewhere nobody reads.
• Trusting domestic traffic because the old worry was foreign addresses.
• Leaving end-of-support devices in place because replacing them needs capital funding and nothing has broken yet.
• Writing continuity plans only for ransomware, where the attacker wants money and leaves, rather than for an adversary who wants to stay and strike later.
• Coordinating a response over the same email system the intruder may be reading.

Water, phones and emergency dispatch

For a city manager, utility general manager or agency head, the risk falls on the services residents depend on most: clean water, working phones, emergency dispatch, functioning ports. The costs of preparation are modest compared with the cost of an outage, and several of the most valuable steps are management decisions rather than technical ones: funding device replacement, insisting on change tickets, approving log retention, and scheduling an exercise.

Councils and boards can track progress with a few figures. Useful ones include the number of internet-facing devices past vendor support and the typical time to patch edge devices. Others are how many days of domain controller logs can be searched today, how many rare administrative actions lacked a change ticket last quarter, and the date of the last manual-mode exercise. Each figure has an owner and moves in a direction everyone can understand.

Regulators and funders increasingly expect these basics, and the public expects services to keep running. A leader who can say “we know our edge, we watch our administrators’ actions, and we have practiced running without the network” is in a far stronger position, with oversight bodies and with residents, than one who discovers these gaps during a crisis.

There is also a workforce dimension. Manual mode depends on people who still know how to run a plant or a dispatch floor by hand, and that knowledge fades when it is never used. Exercises keep it alive, and they show leaders which roles are single points of failure before an adversary does.

The case that this is overblown for a small utility

The strongest objection runs like this. A state-backed actor preparing for a conflict with the United States has bigger targets than a town water system. Ransomware and fraud are far more likely to hit a small utility in any given year. Scarce money should go to those risks first.

The objection is right about likelihood and wrong about the trade-off. Most of the controls here also defend against ransomware: an inventory of edge devices, prompt patching, multi-factor authentication, central logs and a manual mode. The differences are mainly longer log retention, alerts tied to change tickets and plans that assume the intruder is still present. Those are modest additions. The 2024 advisory also stated that some victims were small organizations with limited security capabilities that serve larger organizations or key locations. Small size was not protection.

A council briefing should start at the edge

1. Do we have a complete list of every internet-facing device at every site, including ones installed by contractors, and which are past vendor support?
2. Are command-line, PowerShell and domain controller logs switched on, and how far back can we look today?
3. Would we be alerted if someone copied the Active Directory database or set up new port forwarding without a change ticket?
4. If the network were untrustworthy for a week, how would our most essential service run, with which staff, and have we practiced it?
5. How would our response team communicate if we suspected email was being read, and could we rebuild the directory from a clean state?

With hindsight

The threat proved larger than first described. In January 2024 the Justice Department announced that the FBI had disrupted a network of hundreds of compromised, end-of-life routers that Volt Typhoon used to hide its activity. Those were exactly the kind of forgotten home and small office devices the original reports had pointed to, and the operation showed how much of the campaign ran through equipment no victim owned.

The court-authorized operation targeted a network the Justice Department called the KV botnet, made up mostly of Cisco and NETGEAR routers that no longer received security updates. Agents deleted the malware from the routers and took steps to cut their connection to the botnet. The announcement came on January 31, the same day the FBI director told a House select committee that Chinese hackers were positioning themselves on American infrastructure to cause harm in a crisis.

In February 2024 CISA, the NSA and the FBI said the group had kept access to some victim environments for at least five years. They said it was pre-positioning for disruptive or destructive attacks on communications, energy, transportation and water systems in a conflict. That turned Microsoft’s “moderate confidence” assessment into a much firmer official warning. It also vindicated the emphasis on long log retention: an intruder present for five years cannot be traced with a month of records.

That February advisory was co-signed by the Department of Energy, the EPA and TSA, as well as the original six-country group. It said the actors were pre-positioning on IT networks to move into operational technology, and that at one victim they had extracted the directory database three times over four years. It also recorded that some victims were small organizations serving larger ones or key locations. In March 2024 the EPA administrator and the national security advisor wrote to governors warning of attacks on water systems, citing Volt Typhoon among the threats.

A small public utility later put a face on those warnings. In 2025 the municipal electric and water department in Littleton, Massachusetts, described publicly how the FBI had alerted it in late 2023 to Volt Typhoon activity in its network. It also described how it had worked with outside responders to remove it. The case showed exactly the profile officials had described: a small operator with limited staff, chosen for what it was connected to.

The same agencies published joint guidance on detecting living-off-the-land techniques, giving defenders more practical material for the hardest of the three problems. Later in 2024 a separate China-linked group, known as Salt Typhoon, was found inside major US telecommunications carriers, a reminder that the communications sector named in the first reports was not a one-off target.

The edge kept proving to be the entry point. In August 2024 researchers at Lumen attributed the exploitation of a previously unknown flaw in Versa Director, software used by internet service providers to manage networks, to Volt Typhoon with moderate confidence. China continued to deny the accusations, and in 2024 Chinese government-linked bodies published reports describing Volt Typhoon as a fabrication. Western agencies did not change their assessment.

Support for small operators did not grow in step with the warnings. EPA withdrew its sanitary survey approach to water cybersecurity in October 2023 after the legal challenge, leaving no federal minimum for most water systems. Federal funding for the Multi-State Information Sharing and Analysis Center was cut back in 2025, shifting more of the cost of shared services to states and localities.

Edge device replacement has been the most concrete response and the easiest to fund. It produces a clear list, a clear cost and a clear finish line, which suits budget processes. Behavioral detection and manual-mode planning remain harder, especially for the smallest operators. They depend on staff time, habits and practice rather than purchases.

The cheapest controls here are organizational. Matching admin actions to tickets, keeping logs long enough to matter and rehearsing a week without the network are choices a leadership team can make and check. Those choices are what separate an organization that discovers a long-term intruder from one that never does.