Volt Typhoon Living-off-the-Land APT

What is VOLT-TYPHOON-APT?

VOLT_TYPHOON_APT is a critical-severity malware/security problem. Volt Typhoon is a state-sponsored cyber actor that targets critical infrastructure. They use 'Living-off-the-Land' (LotL) techniques—using legitimate built-in administrative tools like PowerShell, wmic, and netsh—to blend in with normal system activity and maintain long-term undetected persistence. Common triggers are compromised edge devices (SOHO routers, firewalls, VPN appliances) and lack of command-line logging and network telemetry monitoring. Use the steps below to track down and fix the cause.

Common Causes

• Compromised edge devices (SOHO routers, firewalls, VPN appliances)
• Use of stolen administrative credentials
• Lack of command-line logging and network telemetry monitoring

Step-by-Step Fix Guide

• 1
  Enable detailed PowerShell script block logging (Event ID 4104)

  "Enable detailed PowerShell script block logging (Event ID 4104)" is worth trying when lack of command-line logging and network telemetry monitoring turns out to be the culprit.

• 2
  Perform a full audit of built-in system accounts and active sessions

  "Perform a full audit of built-in system accounts and active sessions" handles an edge case some users report with VOLT-TYPHOON-APT.

• 3
  Reset all administrative credentials and domain trust settings

  If earlier steps didn't help, "Reset all administrative credentials and domain trust settings" directly addresses use of stolen administrative credentials.

• 4
  Decommission and replace compromised edge network routing hardware

  If earlier steps didn't help, "Decommission and replace compromised edge network routing hardware" directly addresses compromised edge devices (SOHO routers, firewalls, VPN appliances).

Commands & Diagnostics

Frequently Asked Questions