Trusted Design

Volt Typhoon

アクターID: G1017

· MITRE Pageへのリンク

脅威アクターの詳細

Volt Typhoon is a People's Republic of China (PRC) state-sponsored actor that has been active since at least 2021 primarily targeting critical infrastructure organizations in the US and its territories including Guam. Volt Typhoon's targeting and pattern of behavior have been assessed as pre-positioning to enable lateral movement to operational technology (OT) assets for potential destructive or disruptive attacks. Volt Typhoon has emphasized stealth in operations using web shells, living-off-the-land (LOTL) binaries, hands on keyboard activities, and stolen credentials.(Citation: CISA AA24-038A PRC Critical Infrastructure February 2024)(Citation: Microsoft Volt Typhoon May 2023)(Citation: Joint Cybersecurity Advisory Volt Typhoon June 2023)(Citation: Secureworks BRONZE SILHOUETTE May 2023)

脅威アクターの別名・別称

Volt Typhoon
BRONZE SILHOUETTE
Vanguard Panda
DEV-0391
UNC3236
Voltzite
Insidious Taurus

利用した攻撃手法

• T1560.001 - Archive via Utility
• T1047 - Windows Management Instrumentation
• T1156 - Malicious Shell Modification
• T1557 - Adversary-in-the-Middle
• T1148 - HISTCONTROL
• T1596.003 - Digital Certificates
• T1213.002 - Sharepoint
• T1123 - Audio Capture
• T1099 - Timestomp
• T1685.001 - Disable or Modify Windows Event Log
• T1560.003 - Archive via Custom Method
• T1114 - Email Collection
• T1116 - Code Signing
• T1218.013 - Mavinject
• T1013 - Port Monitors
• T1587.001 - Malware
• T1071.005 - Publish/Subscribe Protocols
• T1592.001 - Hardware
• T1562.009 - Safe Mode Boot
• T1542.005 - TFTP Boot
• T1686.003 - Windows Host Firewall
• T1003.007 - Proc Filesystem
• T1040 - Network Sniffing
• T1553.002 - Code Signing
• T1556.002 - Password Filter DLL
• T1176 - Software Extensions
• T1584.003 - Virtual Private Server
• T1059.010 - AutoHotKey & AutoIT
• T1140 - Deobfuscate/Decode Files or Information
• T1562 - Impair Defenses
• T1567 - Exfiltration Over Web Service
• T1070.008 - Clear Mailbox Data
• T1070.006 - Timestomp
• T1547.005 - Security Support Provider
• T1059.009 - Cloud API
• T1562.012 - Disable or Modify Linux Audit System
• T1555.003 - Credentials from Web Browsers
• T1491 - Defacement
• T1535 - Unused/Unsupported Cloud Regions
• T1547.003 - Time Providers
• T1546.005 - Trap
• T1134.002 - Create Process with Token
• T1164 - Re-opened Applications
• T1590.006 - Network Security Appliances
• T1045 - Software Packing
• T1219.001 - IDE Tunneling
• T1083 - File and Directory Discovery
• T1055.004 - Asynchronous Procedure Call
• T1049 - System Network Connections Discovery
• T1102 - Web Service
• T1583.006 - Web Services
• T1057 - Process Discovery
• T1497.002 - User Activity Based Checks
• T1552.008 - Chat Messages
• T1212 - Exploitation for Credential Access
• T1102.003 - One-Way Communication
• T1199 - Trusted Relationship
• T1056.002 - GUI Input Capture
• T1686.002 - Network Device Firewall
• T1157 - Dylib Hijacking
• T1039 - Data from Network Shared Drive
• T1488 - Disk Content Wipe
• T1566.004 - Spearphishing Voice
• T1570 - Lateral Tool Transfer
• T1166 - Setuid and Setgid
• T1584.002 - DNS Server
• T1065 - Uncommonly Used Port
• T1591.004 - Identify Roles
• T1070.009 - Clear Persistence
• T1537 - Transfer Data to Cloud Account
• T1546.016 - Installer Packages
• T1134 - Access Token Manipulation
• T1209 - Time Providers
• T1159 - Launch Agent
• T1547.013 - XDG Autostart Entries
• T1622 - Debugger Evasion
• T1574.002 - DLL Side-Loading
• T1548.006 - TCC Manipulation
• T1665 - Hide Infrastructure
• T1578.001 - Create Snapshot
• T1569.002 - Service Execution

関連するCVE (攻撃手法に関連)

• CVE-2015-4495 (T1574.002)
• CVE-2015-5749 (T1574.002)
• CVE-2016-1898 (T1488)
• CVE-2016-1897 (T1574.002)
• CVE-2015-7261 (T1562)
• CVE-2015-6036 (T1560.001)
• CVE-2015-7262 (T1039)
• CVE-2015-0932 (T1574.002)
• CVE-2010-3081 (T1574.002)
• CVE-2017-16929 (T1574.002)
• CVE-2025-31125 (T1157)
• CVE-2025-68645 (T1574.002)
• CVE-2014-4114 (T1488)
• CVE-2017-0143 (T1574.002)
• CVE-2013-3906 (T1488)
• CVE-2013-6282 (T1488)
• CVE-2025-55182 (T1055.004)
• CVE-2023-1389 (T1574.002)
• CVE-2025-13928 (T1488)
• CVE-2025-24893 (T1574.002)
• CVE-2025-34026 (T1159)
• CVE-2025-55184 (T1055.004)
• CVE-2015-0071 (T1219.001)
• CVE-2012-4969 (T1591.004)
• CVE-2014-8361 (T1488)
• CVE-2010-2884 (T1591.004)
• CVE-2010-2883 (T1574.002)
• CVE-2012-6422 (T1039)
• CVE-2015-1427 (T1555.003)
• CVE-2015-3456 (T1157)
• CVE-2014-6271 (T1665)
• CVE-2016-1990 (T1039)
• CVE-2014-3153 (T1039)
• CVE-2015-3636 (T1488)
• CVE-2010-0232 (T1574.002)
• CVE-2015-1770 (T1622)
• CVE-2015-2545 (T1049)
• CVE-2014-6332 (T1488)
• CVE-2014-6352 (T1488)
• CVE-2010-0806 (T1547.013)
• CVE-2015-5119 (T1488)
• CVE-2015-5122 (T1574.002)
• CVE-2012-1856 (T1548.006)
• CVE-2015-7645 (T1488)
• CVE-2017-0199 (T1622)
• CVE-2015-3043 (T1134)
• CVE-2015-3090 (T1574.002)
• CVE-2015-3113 (T1488)
• CVE-2015-2590 (T1039)
• CVE-2015-2424 (T1049)
• CVE-2015-0097 (T1049)
• CVE-2012-0158 (T1548.006)
• CVE-2014-1761 (T1488)
• CVE-2015-2502 (T1574.002)
• CVE-2013-2094 (T1039)
• CVE-2016-1010 (T1574.002)
• CVE-2016-1019 (T1488)
• CVE-2016-0984 (T1574.002)
• CVE-2016-1001 (T1574.002)
• CVE-2016-0998 (T1574.002)
• CVE-2015-1641 (T1049)
• CVE-2015-1701 (T1570)
• CVE-2015-0313 (T1488)
• CVE-2015-0359 (T1134)
• CVE-2015-5130 (T1574.002)
• CVE-2015-5134 (T1574.002)
• CVE-2015-5539 (T1574.002)
• CVE-2015-5557 (T1574.002)
• CVE-2015-5563 (T1574.002)
• CVE-2015-5559 (T1574.002)
• CVE-2015-5540 (T1574.002)
• CVE-2015-5561 (T1574.002)
• CVE-2015-5551 (T1574.002)
• CVE-2015-5564 (T1574.002)
• CVE-2015-5565 (T1574.002)
• CVE-2015-5550 (T1574.002)
• CVE-2015-5566 (T1574.002)
• CVE-2015-5127 (T1574.002)
• CVE-2015-5556 (T1574.002)
• CVE-2015-3628 (T1039)
• CVE-2016-1287 (T1574.002)
• CVE-2015-8286 (T1574.002)
• CVE-2015-8287 (T1574.002)
• CVE-2017-0261 (T1134)
• CVE-2017-0262 (T1134)
• CVE-2016-9494 (T1065)
• CVE-2015-0311 (T1488)
• CVE-2012-0056 (T1039)
• CVE-2010-3333 (T1209)
• CVE-2015-0336 (T1039)
• CVE-2014-4322 (T1488)
• CVE-2015-3105 (T1574.002)
• CVE-2014-0497 (T1219.001)
• CVE-2013-0074 (T1219.001)
• CVE-2012-0507 (T1574.002)
• CVE-2014-8439 (T1574.002)
• CVE-2013-2551 (T1488)
• CVE-2014-0569 (T1574.002)
• CVE-2014-0515 (T1488)
• CVE-2015-0310 (T1488)
• CVE-2014-1776 (T1574.002)
• CVE-2014-0556 (T1574.002)
• CVE-2012-1876 (T1219.001)
• CVE-2015-5560 (T1574.002)
• CVE-2012-2539 (T1049)
• CVE-2014-9163 (T1209)
• CVE-2012-1723 (T1574.002)
• CVE-2014-8440 (T1574.002)
• CVE-2010-1297 (T1574.002)
• CVE-2011-3402 (T1488)
• CVE-2013-0634 (T1488)
• CVE-2014-7247 (T1488)
• CVE-2013-2595 (T1039)
• CVE-2015-4902 (T1219.001)
• CVE-2011-0611 (T1574.002)
• CVE-2013-5990 (T1057)
• CVE-2016-0189 (T1219.001)
• CVE-2025-55183 (T1574.002)
• CVE-2014-0329 (T1574.002)
• CVE-2016-2343 (T1574.002)
• CVE-2016-6532 (T1546.005)
• CVE-2016-9495 (T1065)
• CVE-2014-3393 (T1574.002)
• CVE-2012-4792 (T1547.013)
• CVE-2014-4148 (T1488)
• CVE-2016-1991 (T1039)
• CVE-2016-1562 (T1562.012)
• CVE-2012-1258 (T1209)
• CVE-2013-7331 (T1569.002)
• CVE-2025-54313 (T1547.005)
• CVE-2014-4113 (T1570)
• CVE-2015-0016 (T1574.002)
• CVE-2014-0322 (T1488)
• CVE-2015-0057 (T1039)
• CVE-2015-2360 (T1570)
• CVE-2010-4398 (T1209)
• CVE-2015-2546 (T1039)
• CVE-2015-3785 (T1219.001)
• CVE-2015-5897 (T1574.002)
• CVE-2015-8562 (T1488)
• CVE-2015-6034 (T1039)
• CVE-2015-6022 (T1219.001)
• CVE-2017-0263 (T1039)
• CVE-2016-9496 (T1065)
• CVE-2015-1761 (T1488)
• CVE-2013-3660 (T1488)
• CVE-2014-6324 (T1166)
• CVE-2008-1436 (T1488)
• CVE-2014-2273 (T1219.001)
• CVE-2015-2387 (T1039)
• CVE-2017-0001 (T1039)
• CVE-2025-13335 (T1574.002)
• CVE-2025-13927 (T1157)
• CVE-2026-1102 (T1157)
• CVE-2026-20127 (T1065)
• CVE-2016-2342 (T1209)
• CVE-2012-0611 (T1039)
• CVE-2013-2678 (T1488)
• CVE-2026-0723 (T1574.002)
• CVE-2015-2852 (T1219.001)
• CVE-2015-2854 (T1219.001)
• CVE-2015-2853 (T1219.001)
• CVE-2012-3213 (T1574.002)
• CVE-2011-3544 (T1574.002)
• CVE-2017-17215 (T1065)
• CVE-2013-2465 (T1574.002)
• CVE-2010-0188 (T1591.004)
• CVE-2015-2426 (T1049)
• CVE-2014-3897 (T1219.001)
• CVE-2009-3129 (T1209)
• CVE-2010-2572 (T1686.002)
• CVE-2011-1255 (T1548.006)
• CVE-2017-8570 (T1219.001)
• CVE-2015-2419 (T1219.001)
• CVE-2016-4117 (T1488)
• CVE-2025-66478 (T1219.001)
• CVE-2017-12149 (T1102)
• CVE-2010-0738 (T1157)
• CVE-2012-4681 (T1578.001)
• CVE-2015-7808 (T1039)
• CVE-2010-1553 (T1209)
• CVE-2015-5477 (T1574.002)
• CVE-2013-0641 (T1591.004)
• CVE-2013-0640 (T1591.004)
• CVE-2017-7255 (T1134)
• CVE-2014-7911 (T1574.002)

Actor – Pulse グラフ

---

← 脅威アクター一覧に戻る