AdversaryGraph public intelligence page
This page is part of Threat Matrix, the public browser workspace for the main AdversaryGraph platform. Use it for ATT&CK pivots, actor and technique context, similarity leads, detection coverage review, and analyst-ready investigation paths.
Validation disclaimer: TTP overlap, actor similarity, generated summaries, and coverage findings are investigation leads, not attribution proof or operational validation without analyst review.
Main AdversaryGraph project Documentation Malware Analysis GitHub
Volt Typhoon
Aliases: BRONZE SILHOUETTE, DEV-0391, DazedToad, Insidious Taurus, UNC3236, Vanguard Panda, Volt Typhoon, Voltzite
[Volt Typhoon](https://attack.mitre.org/groups/G1017) is a People's Republic of China (PRC) state-sponsored actor that has been active since at least 2021, primarily targeting critical infrastructure organizations in the US and its territories including Guam. [Volt Typhoon](https://attack.mitre.org/groups/G1017)'s targeting and pattern of behavior have been assessed as pre-positioning to enable lateral movement to operational technology (OT) assets for potential destructive or disruptive attacks. [Volt Typhoon](https://attack.mitre.org/groups/G1017) has emphasized stealth in operations using web shells, living-off-the-land (LOTL) binaries, hands on keyboard activities, and stolen credentials.(Citation: CISA AA24-038A PRC Critical Infrastructure February 2024)(Citation: Microsoft Volt Typhoon May 2023)(Citation: Joint Cybersecurity Advisory Volt Typhoon June 2023)(Citation: Secureworks BRONZE SILHOUETTE May 2023). The group has leveraged compromised SOHO routers to proxy command and control traffic and obscure its infrastructure, activity associated with the KV botnet.(Citation: DOJ KVBotnet 2024). Reporting indicates a separate initial access cluster, SYLVANITE, has been observed exploiting internet-facing edge devices and transferring access to [Volt Typhoon](https://attack.mitre.org/groups/G1017), also tracked as VOLTZITE, for follow-on operations. (Citation: Dragos 2025 Year in Review)
Open interactive actor investigation
ATT&CK techniques
T1003.001T1003.003T1005T1006T1007T1010T1012T1016T1016.001T1018T1021.001T1027.002T1033T1036.005T1036.008T1046T1047T1049T1056.001T1057T1059.001T1059.003T1059.004T1068T1069T1069.001T1069.002T1070.004T1070.007T1074T1074.001T1078T1078.002T1083T1087.001T1087.002T1090T1090.001T1090.003T1105T1112T1113T1120T1124T1133T1140T1190T1217T1218T1497.001T1505.003T1518T1552T1552.004T1555T1555.003T1560.001T1570T1573.001T1584.003T1584.004T1584.005T1584.008T1587.004T1588.002T1588.006T1589T1589.002T1590T1590.004T1590.006T1591T1591.004T1592T1593T1594T1596.005T1614T1654T1680T1685.005
Correlated CTI and IR reports
Continue the investigation
Attack tools, simulations and detection rules
Follow explicit source relationships into the reference modules. Linked procedures and detectors are not claims of live validation or actor attribution.
- Mimikatz tool reference — Explicit actor uses software relationship in pinned ATT&CK
- PsExec tool reference — Explicit actor uses software relationship in pinned ATT&CK
- Net tool reference — Explicit actor uses software relationship in pinned ATT&CK
- Tasklist tool reference — Explicit actor uses software relationship in pinned ATT&CK
- Reg tool reference — Explicit actor uses software relationship in pinned ATT&CK
- Systeminfo tool reference — Explicit actor uses software relationship in pinned ATT&CK
- Ping tool reference — Explicit actor uses software relationship in pinned ATT&CK
- ipconfig tool reference — Explicit actor uses software relationship in pinned ATT&CK
- netstat tool reference — Explicit actor uses software relationship in pinned ATT&CK
- cmd tool reference — Explicit actor uses software relationship in pinned ATT&CK
- netsh tool reference — Explicit actor uses software relationship in pinned ATT&CK
- certutil tool reference — Explicit actor uses software relationship in pinned ATT&CK
- Impacket tool reference — Explicit actor uses software relationship in pinned ATT&CK
- Nltest tool reference — Explicit actor uses software relationship in pinned ATT&CK
- Wevtutil tool reference — Explicit actor uses software relationship in pinned ATT&CK
- FRP tool reference — Explicit actor uses software relationship in pinned ATT&CK
- T1003.001 LSASS Memory simulation — Exact active technique ID
- T1003.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1003.003 NTDS simulation — Exact active technique ID
- T1003.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1005 Data from Local System simulation — Exact active technique ID
- T1005 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1006 Direct Volume Access simulation — Exact active technique ID
- T1006 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1007 System Service Discovery simulation — Exact active technique ID
- T1007 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1010 Application Window Discovery simulation — Exact active technique ID
- T1010 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1012 Query Registry simulation — Exact active technique ID
- T1012 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1016 System Network Configuration Discovery simulation — Exact active technique ID
- T1016 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1016.001 Internet Connection Discovery simulation — Exact active technique ID
- T1016.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1018 Remote System Discovery simulation — Exact active technique ID
- T1018 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1021.001 Remote Desktop Protocol simulation — Exact active technique ID
- T1021.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1027.002 Software Packing simulation — Exact active technique ID
- T1027.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1033 System Owner/User Discovery simulation — Exact active technique ID
- T1033 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1036.005 Match Legitimate Resource Name or Location simulation — Exact active technique ID
- T1036.005 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1036.008 Masquerade File Type simulation — Exact active technique ID
- T1036.008 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1046 Network Service Discovery simulation — Exact active technique ID
- T1046 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1047 Windows Management Instrumentation simulation — Exact active technique ID
- T1047 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1049 System Network Connections Discovery simulation — Exact active technique ID
- T1049 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1056.001 Keylogging simulation — Exact active technique ID
- T1056.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1057 Process Discovery simulation — Exact active technique ID
- T1057 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1059.001 PowerShell simulation — Exact active technique ID
- T1059.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1059.003 Windows Command Shell simulation — Exact active technique ID
- T1059.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1059.004 Unix Shell simulation — Exact active technique ID
- T1059.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1068 Exploitation for Privilege Escalation simulation — Exact active technique ID
- T1068 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1069 Permission Groups Discovery simulation — Exact active technique ID
- T1069 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1069.001 Local Groups simulation — Exact active technique ID
- T1069.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1069.002 Domain Groups simulation — Exact active technique ID
- T1069.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1070.004 File Deletion simulation — Exact active technique ID
- T1070.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1070.007 Clear Network Connection History and Configurations simulation — Exact active technique ID
- T1070.007 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1074 Data Staged simulation — Exact active technique ID
- T1074 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1074.001 Local Data Staging simulation — Exact active technique ID
- T1074.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1078 Valid Accounts simulation — Exact active technique ID
- T1078 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1078.002 Domain Accounts simulation — Exact active technique ID
- T1078.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1083 File and Directory Discovery simulation — Exact active technique ID
- T1083 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1087.001 Local Account simulation — Exact active technique ID
- T1087.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1087.002 Domain Account simulation — Exact active technique ID
- T1087.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1090 Proxy simulation — Exact active technique ID
- T1090 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1090.001 Internal Proxy simulation — Exact active technique ID
- T1090.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1090.003 Multi-hop Proxy simulation — Exact active technique ID
- T1090.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1105 Ingress Tool Transfer simulation — Exact active technique ID
- T1105 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1112 Modify Registry simulation — Exact active technique ID
- T1112 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1113 Screen Capture simulation — Exact active technique ID
- T1113 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1120 Peripheral Device Discovery simulation — Exact active technique ID
- T1120 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1124 System Time Discovery simulation — Exact active technique ID
- T1124 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1133 External Remote Services simulation — Exact active technique ID
- T1133 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1140 Deobfuscate/Decode Files or Information simulation — Exact active technique ID
- T1140 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1190 Exploit Public-Facing Application simulation — Exact active technique ID
- T1190 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1217 Browser Information Discovery simulation — Exact active technique ID
- T1217 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1218 System Binary Proxy Execution simulation — Exact active technique ID
- T1218 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1497.001 System Checks simulation — Exact active technique ID
- T1497.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1505.003 Web Shell simulation — Exact active technique ID
- T1505.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1518 Software Discovery simulation — Exact active technique ID
- T1518 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1552 Unsecured Credentials simulation — Exact active technique ID
- T1552 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1552.004 Private Keys simulation — Exact active technique ID
- T1552.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1555 Credentials from Password Stores simulation — Exact active technique ID
- T1555 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1555.003 Credentials from Web Browsers simulation — Exact active technique ID
- T1555.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1560.001 Archive via Utility simulation — Exact active technique ID
- T1560.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1570 Lateral Tool Transfer simulation — Exact active technique ID
- T1570 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1573.001 Symmetric Cryptography simulation — Exact active technique ID
- T1573.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1584.003 Virtual Private Server simulation — Exact active technique ID
- T1584.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1584.004 Server simulation — Exact active technique ID
- T1584.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1584.005 Botnet simulation — Exact active technique ID
- T1584.005 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1584.008 Network Devices simulation — Exact active technique ID
- T1584.008 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1587.004 Exploits simulation — Exact active technique ID
- T1587.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1588.002 Tool simulation — Exact active technique ID
- T1588.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1588.006 Vulnerabilities simulation — Exact active technique ID
- T1588.006 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1589 Gather Victim Identity Information simulation — Exact active technique ID
- T1589 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1589.002 Email Addresses simulation — Exact active technique ID
- T1589.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1590 Gather Victim Network Information simulation — Exact active technique ID
- T1590 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1590.004 Network Topology simulation — Exact active technique ID
- T1590.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1590.006 Network Security Appliances simulation — Exact active technique ID
- T1590.006 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1591 Gather Victim Org Information simulation — Exact active technique ID
- T1591 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1591.004 Identify Roles simulation — Exact active technique ID
- T1591.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1592 Gather Victim Host Information simulation — Exact active technique ID
- T1592 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1593 Search Open Websites/Domains simulation — Exact active technique ID
- T1593 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1594 Search Victim-Owned Websites simulation — Exact active technique ID
- T1594 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1596.005 Scan Databases simulation — Exact active technique ID
- T1596.005 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1614 System Location Discovery simulation — Exact active technique ID
- T1614 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1654 Log Enumeration simulation — Exact active technique ID
- T1654 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1680 Local Storage Discovery simulation — Exact active technique ID
- T1680 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1685.005 Clear Windows Event Logs simulation — Exact active technique ID
- T1685.005 detection rules — Exact active technique ID; not actor-specific detector coverage
Cyber Knowledge routes
These contextual routes explain behaviors associated with this ATT&CK group record. They support learning and investigation planning; they do not add attribution evidence.
Module 1 — Foundations: What CTI Is
Cyber Threat Intelligence (CTI) · explicit-idModule 3 — Core Frameworks Models
Cyber Threat Intelligence (CTI) · explicit-idModule 8 — Operationalizing CTI (CTI → Detection)
Cyber Threat Intelligence (CTI) · explicit-idModule 4 — Detection engineering and detection as code
Blue Team & Defensive Security · explicit-idExploitability validation and laboratory exploit engineering
Vulnerability Research & Exploit Development · explicit-idModule 5 — Threat hunting
Blue Team & Defensive Security · explicit-nameWindows endpoint and identity forensics
Digital Forensics & Incident Response (DFIR) · explicit-nameModule 7 — Privilege, lateral movement, and controlled impact
Red Team & Offensive Security · explicit-nameModule 4 — Web applications and APIs
Red Team & Offensive Security · explicit-nameModule 9 — AI-assisted offensive security and MCP
Red Team & Offensive Security · explicit-nameModule 10 — Laboratories, tool discipline, and reporting
Red Team & Offensive Security · explicit-nameModule 11 — Mobile and thick-client security
Red Team & Offensive Security · explicit-name
Cyber Threat Intelligence (CTI) · explicit-idModule 3 — Core Frameworks Models
Cyber Threat Intelligence (CTI) · explicit-idModule 8 — Operationalizing CTI (CTI → Detection)
Cyber Threat Intelligence (CTI) · explicit-idModule 4 — Detection engineering and detection as code
Blue Team & Defensive Security · explicit-idExploitability validation and laboratory exploit engineering
Vulnerability Research & Exploit Development · explicit-idModule 5 — Threat hunting
Blue Team & Defensive Security · explicit-nameWindows endpoint and identity forensics
Digital Forensics & Incident Response (DFIR) · explicit-nameModule 7 — Privilege, lateral movement, and controlled impact
Red Team & Offensive Security · explicit-nameModule 4 — Web applications and APIs
Red Team & Offensive Security · explicit-nameModule 9 — AI-assisted offensive security and MCP
Red Team & Offensive Security · explicit-nameModule 10 — Laboratories, tool discipline, and reporting
Red Team & Offensive Security · explicit-nameModule 11 — Mobile and thick-client security
Red Team & Offensive Security · explicit-name