Grupo APTMITRE G1017

Volt Typhoon

También conocido como: bronze silhouette, dazedtoad, dev-0391, insidious taurus, storm-0391, unc3236, vanguard panda, voltzite

[Volt Typhoon](https://attack.mitre.org/groups/G1017) is a People's Republic of China (PRC) state-sponsored actor that has been active since at least 2021, primarily targeting critical infrastructure organizations in the US and its territories including Guam. [Volt Typhoon](https://attack.mitre.org/groups/G1017)'s targeting and pattern of behavior have been assessed as pre-positioning to enable lateral movement to operational technology (OT) assets for potential destructive or disruptive attacks. [Volt Typhoon](https://attack.mitre.org/groups/G1017) has emphasized stealth in operations using web shells, living-off-the-land (LOTL) binaries, hands on keyboard activities, and stolen credentials.(Citation: CISA AA24-038A PRC Critical Infrastructure February 2024)(Citation: Microsoft Volt Typhoon May 2023)(Citation: Joint Cybersecurity Advisory Volt Typhoon June 2023)(Citation: Secureworks BRONZE SILHOUETTE May 2023). The group has leveraged compromised SOHO routers to proxy command and control traffic and obscure its infrastructure, activity associated with the KV botnet.(Citation: DOJ KVBotnet 2024). Reporting indicates a separate initial access cluster, SYLVANITE, has been observed exploiting internet-facing edge devices and transferring access to [Volt Typhoon](https://attack.mitre.org/groups/G1017), also tracked as VOLTZITE, for follow-on operations. (Citation: Dragos 2025 Year in Review)

Víctimas en los últimos 90 días0

Países más afectados

Sin datos todavía.

Sectores más afectados

Sin datos todavía.

Mitigaciones prioritarias

Mitigaciones de MITRE ATT&CK que cubren más técnicas de las que usa este grupo.

Gestión de cuentas privilegiadas (11 técnicas cubiertas)
Gestión de cuentas de usuario (8 técnicas cubiertas)
Políticas de contraseñas (8 técnicas cubiertas)
Prevención de ejecución (8 técnicas cubiertas)
Filtrar el tráfico de red (7 técnicas cubiertas)
Formación de usuarios (6 técnicas cubiertas)
Prevención de intrusiones en red (6 técnicas cubiertas)
Desactivar o eliminar funciones o programas (6 técnicas cubiertas)

Técnicas MITRE ATT&CK

T1046 · Network Service Discovery T1083 · File and Directory Discovery T1591.004 · Identify Roles T1057 · Process Discovery T1021.001 · Remote Desktop Protocol T1584.004 · Server T1090 · Proxy T1518 · Software Discovery T1078 · Valid Accounts T1584.008 · Network Devices T1056.001 · Keylogging T1036.005 · Match Legitimate Resource Name or Location T1036.008 · Masquerade File Type T1059.003 · Windows Command Shell T1190 · Exploit Public-Facing Application T1555 · Credentials from Password Stores T1074 · Data Staged T1590 · Gather Victim Network Information T1560.001 · Archive via Utility T1124 · System Time Discovery T1069.002 · Domain Groups T1016 · System Network Configuration Discovery T1018 · Remote System Discovery T1047 · Windows Management Instrumentation T1133 · External Remote Services T1140 · Deobfuscate/Decode Files or Information T1570 · Lateral Tool Transfer T1593 · Search Open Websites/Domains T1680 · Local Storage Discovery T1589.002 · Email Addresses T1497.001 · System Checks T1003.003 · NTDS T1027.002 · Software Packing T1573.001 · Symmetric Cryptography T1003.001 · LSASS Memory T1685.005 · Clear Windows Event Logs T1584.005 · Botnet T1592 · Gather Victim Host Information T1049 · System Network Connections Discovery T1087.001 · Local Account T1217 · Browser Information Discovery T1059.001 · PowerShell T1654 · Log Enumeration T1068 · Exploitation for Privilege Escalation T1113 · Screen Capture T1090.001 · Internal Proxy T1587.004 · Exploits T1090.003 · Multi-hop Proxy T1594 · Search Victim-Owned Websites T1033 · System Owner/User Discovery T1112 · Modify Registry T1505.003 · Web Shell T1218 · System Binary Proxy Execution T1059.004 · Unix Shell T1007 · System Service Discovery T1069 · Permission Groups Discovery T1584.003 · Virtual Private Server T1555.003 · Credentials from Web Browsers T1591 · Gather Victim Org Information T1590.004 · Network Topology

Víctimas recientes

Sin datos todavía.

Las reivindicaciones las publican los propios grupos criminales y no están verificadas hasta que la organización o la prensa las confirman. Los nombres de personas físicas (autónomos, profesionales individuales) se anonimizan conforme al RGPD. Nunca enlazamos a sitios de filtración ni a datos robados. Para solicitar la retirada o anonimización de una entrada, contacte con el administrador del sitio.

Fuentes: RansomLook (CC BY 4.0), MITRE ATT&CK®, MISP Galaxy, Google News.